Bug #75986 [Com]: JSON parser not following preposed RFC

Edit report at https://bugs.php.net/bug.php?id=75986&edit=1 ID: 75986 Comment by: welfordmartin at gmail dot com Reported by: welfordmartin at gmail dot com Summary: JSON parser not following preposed RFC Status: Not a bug Type: Bug Package: JSON related Operating System: Ubuntu Server 16.04 & Windows 10 PHP Version: 7.2.2 Block user comment: N Private report: N New Comment: The JSON is valid according to https://www.freeformatter.com/json-validator.html however, it fails on https://jsonlint.com/ and https://jsonformatter.curiousconcept.com/ while the latter says it's an invalid character at [Code 18, Structure 25] highlighting the UTF-8 chars as a problem so I think both of them are also not using a validator that does not conform to RFC4627 Previous Comments: ------------------------------------------------------------------------ [2018-02-20 14:07:57] nikic@php.net Your JSON contains invalid escape sequences. \d is not valid JSON. \x7D is not valid JSON. The correct syntax is \\d and \u007D respectively. ------------------------------------------------------------------------ [2018-02-20 14:00:41] welfordmartin at gmail dot com Description: ------------ When using json_decode to decode a string value containing "{" or "}" the validation fails and it does not produce an object this even happens when both are UTF-8 encoded with "\x7B" and "\x7D" respectfully. both cases cause a 'JSON_ERROR_SYNTAX', While the JSON code has been manually checked against the RFC4627 and it says standard C strings well I can't believe I have to point this one out to you but using "{" and "}" are both ASCII chars so valid in a string. The JSON also parses correctly in Web Browsers both Chrome, Edge & IE parsers. JSON Code used: { "defaultModel":"Campaign", "routes" : { "getCampaignsForWebsite":{ "scope" : "read_campaigns", "api":{ "method" : "GET", "uri" : "/campaign/\x7BdisplayType\x7D/\x7Bwebsite_id:\d+\x7D" }, "perms":{ "module" : "website", "requirement" : "read" } }, "getSingleCampaign":{ "scope" : "read_campaigns", "api":{ "method" : "GET", "uri" : "/campaign/\x7Bcampaign_id:\d+\x7D" }, "perms":{ "module" : "campaign", "requirement" : "read" } } } } Test script: --------------- $raw = file_get_contents("test.json"); $json = json_decode($raw, true); switch (json_last_error()) { case JSON_ERROR_NONE: echo ' - No errors'; break; case JSON_ERROR_DEPTH: echo ' - Maximum stack depth exceeded'; break; case JSON_ERROR_STATE_MISMATCH: echo ' - Underflow or the modes mismatch'; break; case JSON_ERROR_CTRL_CHAR: echo ' - Unexpected control character found'; break; case JSON_ERROR_SYNTAX: echo ' - Syntax error, malformed JSON'; break; case JSON_ERROR_UTF8: echo ' - Malformed UTF-8 characters, possibly incorrectly encoded'; break; default: echo ' - Unknown error'; break; } Expected result: ---------------- I expect an array result when using assoc or a stdClass object when not. Actual result: -------------- Null and json_last_error results in JSON_ERROR_SYNTAX ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=75986&edit=1