From d24bc9e5d6e9c79de0c154992108a91ce5c8970b Mon Sep 17 00:00:00 2001 From: Sean Leary Date: Sun, 19 Jul 2026 12:51:08 -0500 Subject: [PATCH 1/2] pre-release-20260719 initial commit --- README.md | 2 +- build.gradle | 2 +- docs/RELEASES.md | 2 ++ pom.xml | 2 +- 4 files changed, 5 insertions(+), 3 deletions(-) diff --git a/README.md b/README.md index 40acb8f06..b60cd1827 100644 --- a/README.md +++ b/README.md @@ -11,7 +11,7 @@ JSON in Java [package org.json] [![CodeQL](https://github.com/stleary/JSON-java/actions/workflows/codeql-analysis.yml/badge.svg)](https://github.com/stleary/JSON-java/actions/workflows/codeql-analysis.yml) [![javadoc](https://javadoc.io/badge2/org.json/json/javadoc.svg)](https://javadoc.io/doc/org.json/json) -**[Click here if you just want the latest release jar file.](https://search.maven.org/remotecontent?filepath=org/json/json/20260522/json-20260522.jar)** +**[Click here if you just want the latest release jar file.](https://search.maven.org/remotecontent?filepath=org/json/json/202607119/json-20260719.jar)** # Overview diff --git a/build.gradle b/build.gradle index d8b69805f..f9251816c 100644 --- a/build.gradle +++ b/build.gradle @@ -42,7 +42,7 @@ subprojects { } group = 'org.json' -version = 'v20260522-SNAPSHOT' +version = 'v20260719-SNAPSHOT' description = 'JSON in Java' sourceCompatibility = '1.8' diff --git a/docs/RELEASES.md b/docs/RELEASES.md index 7513766ff..43edf3ae5 100644 --- a/docs/RELEASES.md +++ b/docs/RELEASES.md @@ -5,6 +5,8 @@ and artifactId "json". For example: [https://search.maven.org/search?q=g:org.json%20AND%20a:json&core=gav](https://search.maven.org/search?q=g:org.json%20AND%20a:json&core=gav) ~~~ +20260719 Fixes CVE-2026-59171 very large BigInteger, BigDecimal + 20260522 Publish key data, recent commits for minor fixes 20251224 Records, fromJson(), and recent commits diff --git a/pom.xml b/pom.xml index 3f15d6896..d5fb42ddc 100644 --- a/pom.xml +++ b/pom.xml @@ -3,7 +3,7 @@ org.json json - 20260522 + 20260719 bundle JSON in Java From da757c6656a84fe87cb4442f16153b3efe2ccaf3 Mon Sep 17 00:00:00 2001 From: Sean Leary Date: Sun, 19 Jul 2026 13:48:18 -0500 Subject: [PATCH 2/2] pre-release-20260719 oops forgot to update new unit tests for strict mode --- .../java/org/json/junit/JSONObjectTest.java | 87 ++++++++++++------- 1 file changed, 57 insertions(+), 30 deletions(-) diff --git a/src/test/java/org/json/junit/JSONObjectTest.java b/src/test/java/org/json/junit/JSONObjectTest.java index fabaa5a31..6b692789e 100644 --- a/src/test/java/org/json/junit/JSONObjectTest.java +++ b/src/test/java/org/json/junit/JSONObjectTest.java @@ -3885,6 +3885,7 @@ public void jsonObjectParseFromJson_9() { @Test public void testMaxNumberLength() { + JSONParserConfiguration jsonParserConfiguration = new JSONParserConfiguration(); StringBuilder sb = new StringBuilder(); for (int i = 0; i < 100; ++i) { sb.append("9999999999"); @@ -3896,11 +3897,14 @@ public void testMaxNumberLength() { // JSONArray with number just under the max length limit checkJSONArrayMaxLen(sb.toString(), true, null); - // JSONObject with number just over the max length limit - checkJSONObjectMaxLen(sb + "9", false, null); + // numbers without quotes are not allowed in strict mode + if (!jsonParserConfiguration.isStrictMode()) { + // JSONObject with number just over the max length limit + checkJSONObjectMaxLen(sb + "9", false, null); - // JSONArray with number just over the max length limit - checkJSONArrayMaxLen(sb + "9", false, null); + // JSONArray with number just over the max length limit + checkJSONArrayMaxLen(sb + "9", false, null); + } // JSONObject with number at config max length limit checkJSONObjectMaxLen(sb.toString() + sb.toString(), true, new JSONParserConfiguration().withMaxNumberLength(2000)); @@ -3908,11 +3912,14 @@ public void testMaxNumberLength() { // JSONArray with number at config max length limit checkJSONArrayMaxLen((sb.toString() + sb), true, new JSONParserConfiguration().withMaxNumberLength(2000)); - // JSONObject with number just over config max length limit - checkJSONObjectMaxLen(sb.toString() + sb.toString() + "9", false, new JSONParserConfiguration().withMaxNumberLength(2000)); + // numbers without quotes are not allowed in strict mode + if (!jsonParserConfiguration.isStrictMode()) { + // JSONObject with number just over config max length limit + checkJSONObjectMaxLen(sb.toString() + sb.toString() + "9", false, new JSONParserConfiguration().withMaxNumberLength(2000)); - // JSONArray with number just over config max length limit - checkJSONArrayMaxLen((sb.toString() + sb + "9"), false, new JSONParserConfiguration().withMaxNumberLength(2000)); + // JSONArray with number just over config max length limit + checkJSONArrayMaxLen((sb.toString() + sb + "9"), false, new JSONParserConfiguration().withMaxNumberLength(2000)); + } // JSONObject with large number, no checks checkJSONObjectMaxLen(sb.toString() + sb.toString() + "9", true, @@ -3975,6 +3982,8 @@ private static void checkJSONArrayMaxLen(String s, boolean isValid, JSONParserCo */ @Test public void testMaxNumberLengthNegativeInteger() { + JSONParserConfiguration jsonParserConfiguration = new JSONParserConfiguration(); + // Build a negative number string of exactly 1000 chars: "-" + 999 digits StringBuilder sb = new StringBuilder("-"); for (int i = 0; i < 999; ++i) { @@ -3985,10 +3994,13 @@ public void testMaxNumberLengthNegativeInteger() { // at max length: parsed as number checkJSONObjectMaxLen(sb.toString(), true, null); - // over max length: returned as string - sb.append("1"); - assertEquals(1001, sb.length()); - checkJSONObjectMaxLen(sb.toString(), false, null); + // numbers without quotes are not allowed in strict mode + if (!jsonParserConfiguration.isStrictMode()) { + // over max length: returned as string + sb.append("1"); + assertEquals(1001, sb.length()); + checkJSONObjectMaxLen(sb.toString(), false, null); + } } /** @@ -3996,6 +4008,8 @@ public void testMaxNumberLengthNegativeInteger() { */ @Test public void testMaxNumberLengthDecimal() { + JSONParserConfiguration jsonParserConfiguration = new JSONParserConfiguration(); + // Build a decimal number string of exactly 1000 chars: 499 digits + "." + 500 // digits StringBuilder sb = new StringBuilder(); @@ -4011,10 +4025,13 @@ public void testMaxNumberLengthDecimal() { // at max length: parsed as number (BigDecimal) checkJSONObjectMaxLen(sb.toString(), true, null); - // over max length: returned as string - sb.append("3"); - assertEquals(1001, sb.length()); - checkJSONObjectMaxLen(sb.toString(), false, null); + // numbers without quotes are not allowed in strict mode + if (!jsonParserConfiguration.isStrictMode()) { + // over max length: returned as string + sb.append("3"); + assertEquals(1001, sb.length()); + checkJSONObjectMaxLen(sb.toString(), false, null); + } } /** @@ -4022,6 +4039,8 @@ public void testMaxNumberLengthDecimal() { */ @Test public void testMaxNumberLengthScientificNotation() { + JSONParserConfiguration jsonParserConfiguration = new JSONParserConfiguration(); + // Build a scientific notation string of exactly 1000 chars StringBuilder sb = new StringBuilder("1."); for (int i = 0; i < 994; ++i) { @@ -4038,9 +4057,13 @@ public void testMaxNumberLengthScientificNotation() { for (int i = 0; i < 995; ++i) { sb.append("0"); } - sb.append("e100"); - assertEquals(1001, sb.length()); - checkJSONObjectMaxLen(sb.toString(), false, null); + + // numbers without quotes are not allowed in strict mode + if (!jsonParserConfiguration.isStrictMode()) { + sb.append("e100"); + assertEquals(1001, sb.length()); + checkJSONObjectMaxLen(sb.toString(), false, null); + } } /** @@ -4297,17 +4320,21 @@ public void testStringToValueViaJSONObject() { */ @Test public void testStringToNumberInvalidFormats() { - // Leading zero followed by digit → treated as string (not octal) - JSONObject jo = new JSONObject("{\"a\": 01}"); - // JSONTokener with strict mode would reject, but default mode stores as string - // since stringToNumber throws NumberFormatException for "01" - Object val = jo.get("a"); - assertTrue("01 should be stored as string, got " + val.getClass(), val instanceof String); - - // Negative with leading zero → "-01" - jo = new JSONObject("{\"a\": -01}"); - val = jo.get("a"); - assertTrue("-01 should be stored as string, got " + val.getClass(), val instanceof String); + // this test should only run in non-strict mode, otherwise it will throw an exception + JSONParserConfiguration jsonParserConfiguration = new JSONParserConfiguration(); + if (!jsonParserConfiguration.isStrictMode()) { + // Leading zero followed by digit → treated as string (not octal) + JSONObject jo = new JSONObject("{\"a\": 01}"); + // JSONTokener with strict mode would reject, but default mode stores as string + // since stringToNumber throws NumberFormatException for "01" + Object val = jo.get("a"); + assertTrue("01 should be stored as string, got " + val.getClass(), val instanceof String); + + // Negative with leading zero → "-01" + jo = new JSONObject("{\"a\": -01}"); + val = jo.get("a"); + assertTrue("-01 should be stored as string, got " + val.getClass(), val instanceof String); + } } }