Skip to content

Fix parsing JSON array of string with comma#5604

Merged
HofiOne merged 1 commit intosyslog-ng:developfrom
smortex:fix-json-array-with-comma
Jan 21, 2026
Merged

Fix parsing JSON array of string with comma#5604
HofiOne merged 1 commit intosyslog-ng:developfrom
smortex:fix-json-array-with-comma

Conversation

@smortex
Copy link
Contributor

@smortex smortex commented Jan 16, 2026

When a JSON array is parsed, a string value containing a comma and no single or double quote is kept as-is and added to a list. The comma being a delimiter for list items, when the list is serialized to JSON again, that comma is not treated as a part of the original string, but as a separator:

["a", "b", "c,d"]    -> "a,b,c,d"
["a", "b", "c", "d"] <- "a,b,c,d"

Add the comma to the list of forbidden symbols in a string to force quoting of the value,preventing this bug:

["a", "b", "c,d"] -> "a,b,\"c,d\""
["a", "b", "c,d"] <- "a,b,\"c,d\""

@kira-syslogng
Copy link
Contributor

Can one of the admins verify this patch?

1 similar comment
@kira-syslogng
Copy link
Contributor

Can one of the admins verify this patch?

@HofiOne
Copy link
Collaborator

HofiOne commented Jan 16, 2026

@smortex, to be honest, at first I was looking for a generic solution that can be parameterized. This one also has an effect in most cases, and that is the reason I am not sure it can be applied everywhere. str_repr_encode_append is called in multiple cases (XML, map, list, etc.), and I am not sure whether this is needed — moreover, whether it is even allowed in all cases.

Edit: Upps, I forgot the most important part! Thank you for the contribution! ;)

@smortex
Copy link
Contributor Author

smortex commented Jan 16, 2026

Yeah, it might not be optimal.

In fact I was expecting to find some kind of data structure that contained items in a list, and realized this was basically just a string and that there was code to manage quotes, so I tried to tweak it and see how the test suite broke with that change. To my surprise it did not break many tests, and the few broken ones made sense, telling me that this was either something doable, or an area that lacks a lot of tests 😁. I hoped for the former!

Today, I downloaded the artifacts form CI (nice! I do not recall they existed) and installed the package on one of my systems and this indeed fix this issue. I really don't have the knowledge required to tell where we can/should put code to handle this specific issue if the str_repr_encode_append is not suitable, but I will be happy to try to update this PR if you can guide me.

Thank you!

@HofiOne
Copy link
Collaborator

HofiOne commented Jan 19, 2026

Today, I downloaded the artifacts form CI (nice! I do not recall they existed) and installed the package on one of my systems and this indeed fix this issue. I really don't have the knowledge required to tell where we can/should put code to handle this specific issue if the str_repr_encode_append is not suitable, but I will be happy to try to update this PR if you can guide me.

Whish I could, but I have to check and test all the cases too, as I nearly never touched/saw this part of the code yet.
I will examine this later, but I have some other stuff to finish first, sorry.

@bazsi
Copy link
Collaborator

bazsi commented Jan 19, 2026

The right fix is to include the comma as in the forbidden_chars argument to str_repr_encode() when it is called from the Json parser.

That should properly escape the comma and will not change the default behavior for the encode function

When a JSON array is parsed, a string value containing a comma and no
single or double quote is kept as-is and added to a list.  The comma
being a delimiter for list items, when the list is serialized to JSON
again, that comma is not treated as a part of the original string, but
as a separator:

```
["a", "b", "c,d"]    -> "a,b,c,d"
["a", "b", "c", "d"] <- "a,b,c,d"
```

Add the comma to the list of forbidden chars in a string to force
quoting of the value, preventing this bug:

```
["a", "b", "c,d"] -> "a,b,\"c,d\""
["a", "b", "c,d"] <- "a,b,\"c,d\""
```

Signed-off-by: Romain Tartière <[email protected]>
@smortex smortex force-pushed the fix-json-array-with-comma branch from 942daa3 to 05e6d10 Compare January 19, 2026 18:26
@smortex
Copy link
Contributor Author

smortex commented Jan 19, 2026

Thanks @bazsi! I did not checked previously, but as there is a single call to str_repr_encode[_append](), that makes sense. I adjusted this PR to do this and limited the changes to the scope of the json module.

@smortex smortex marked this pull request as ready for review January 19, 2026 18:31
@HofiOne
Copy link
Collaborator

HofiOne commented Jan 20, 2026

Thanks to both of you! I will review this within a few days.

@HofiOne HofiOne merged commit e3bb0e5 into syslog-ng:develop Jan 21, 2026
112 of 118 checks passed
HofiOne added a commit to HofiOne/syslog-ng that referenced this pull request Jan 21, 2026
HofiOne added a commit to HofiOne/syslog-ng that referenced this pull request Jan 21, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants