GROOVY-12272: Validate JSON string escapes where they are read - #2809
Open
paulk-asert wants to merge 1 commit into
Open
GROOVY-12272: Validate JSON string escapes where they are read#2809paulk-asert wants to merge 1 commit into
paulk-asert wants to merge 1 commit into
Conversation
JsonLexer's string branch appended one character at a time and, at every
unescaped quote, re-validated the whole accumulated token by copying it to
a String and running two regular expressions over it. For a well formed
string the closing quote is the first unescaped one, so that happened once.
For a string holding an invalid escape the validation could never succeed,
so the loop consumed the rest of the document and paid the cost again at
every quote it passed, giving O(n^2) behaviour on input an author controls.
Measured on a document of the shape {"k":"\q" followed by n quotes, parsed
with JsonSlurperClassic:
quotes before after
2,000 42 ms 4 ms
4,000 67 ms 0 ms
8,000 220 ms 0 ms
16,000 874 ms 0 ms
Read and check each escape sequence where the backslash is found instead.
The scan becomes linear, the accepted language is unchanged, and a bad
escape is now reported at its own position rather than after the document
has been consumed to its end. Escape-state tracking is no longer needed,
since consuming the sequence in place is what distinguishes an escaped
quote from a closing one.
Note the reach is wider than the parser: JsonOutput.prettyPrint(String)
lexes through the same class, so it shared the behaviour.
Codecov Report❌ Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## master #2809 +/- ##
==================================================
+ Coverage 70.1516% 70.1755% +0.0239%
- Complexity 35828 35845 +17
==================================================
Files 1562 1562
Lines 132523 132542 +19
Branches 24379 24384 +5
==================================================
+ Hits 92967 93012 +45
+ Misses 31140 31114 -26
Partials 8416 8416
🚀 New features to boost your workflow:
|
blackdrag
approved these changes
Aug 18, 2026
✅ All tests passed ✅🏷️ Commit: db9e70b Learn more about TestLens at testlens.app. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
JsonLexer's string branch appended one character at a time and, at every unescaped quote, re-validated the whole accumulated token by copying it to a String and running two regular expressions over it. For a well formed string the closing quote is the first unescaped one, so that happened once. For a string holding an invalid escape the validation could never succeed, so the loop consumed the rest of the document and paid the cost again at every quote it passed, giving O(n^2) behaviour on input an author controls.
Measured on a document of the shape {"k":"\q" followed by n quotes, parsed with JsonSlurperClassic:
quotes before after
2,000 42 ms 4 ms
4,000 67 ms 0 ms
8,000 220 ms 0 ms
16,000 874 ms 0 ms
Read and check each escape sequence where the backslash is found instead. The scan becomes linear, the accepted language is unchanged, and a bad escape is now reported at its own position rather than after the document has been consumed to its end. Escape-state tracking is no longer needed, since consuming the sequence in place is what distinguishes an escaped quote from a closing one.
Note the reach is wider than the parser: JsonOutput.prettyPrint(String) lexes through the same class, so it shared the behaviour.