5 ms·
Some parsers, like PHP, may treat 65537 and "65537" the same. Room for vulnerability.
by deepsun 1y ago
Some parsers, like PHP, may treat 65537 and "65537" the same. Room for vulnerability.
- int_19h 1y agoWhy would they do so? It's semantically distinct JSON, even JS itself treats it differently?
- hiciu 1y agoIt's PHP. Handling numbers in PHP is complicated enough that a reasonable person would not trust it by default. https://www.php.net/manual/en/language.types.numeric-strings.php https://www.php.net/manual/en/language.types.numeric-strings...
- int_19h 1y agoI know that PHP will treat a string as if it were a number if you try to use it in a context where number is expected; JS does the same thing. But why would that affect JSON deserialization in a way that makes numbers and strings indistinguishable in principle (causing the loss of precision as described here)?
- dwattttt 1y agoTime for a trip to the Abbey of Hidden Absurdities. http://www.thecodelesscode.com/case/161 http://www.thecodelesscode.com/case/161