From e75274338f1d70a8c8cfdc4b15d53b5a0097c9e8 Mon Sep 17 00:00:00 2001
From: Andy Frank <afrankvt@gmail.com>
Date: Tue, 19 Mar 2024 16:26:08 -0400
Subject: [PATCH] util: Fix JsonOutStream to disallow invalid Float literals

---
 src/util/fan/JsonOutStream.fan | 22 ++++++++++++++++------
 src/util/test/JsonTest.fan     |  6 +++++-
 2 files changed, 21 insertions(+), 7 deletions(-)

diff --git a/src/util/fan/JsonOutStream.fan b/src/util/fan/JsonOutStream.fan
index e193a6ecb..58f2d81c1 100644
--- a/src/util/fan/JsonOutStream.fan
+++ b/src/util/fan/JsonOutStream.fan
@@ -66,12 +66,13 @@ class JsonOutStream : OutStream
   **
   This writeJson(Obj? obj)
   {
-         if (obj is Str)  writeJsonStr(obj)
-    else if (obj is Num)  writeJsonNum(obj)
-    else if (obj is Bool) writeJsonBool(obj)
-    else if (obj is Map)  writeJsonMap(obj)
-    else if (obj is List) writeJsonList(obj)
-    else if (obj == null) writeJsonNull
+         if (obj is Str)   writeJsonStr(obj)
+    else if (obj is Map)   writeJsonMap(obj)
+    else if (obj is List)  writeJsonList(obj)
+    else if (obj is Float) writeJsonFloat(obj)
+    else if (obj is Num)   writeJsonNum(obj)
+    else if (obj is Bool)  writeJsonBool(obj)
+    else if (obj == null)  writeJsonNull
     else writeJsonObj(obj)
     return this
   }
@@ -159,6 +160,15 @@ class JsonOutStream : OutStream
     writeChar(JsonToken.quote)
   }
 
+  private Void writeJsonFloat(Float float)
+  {
+    // check for unsupported literals
+    if (float.isNaN || float == Float.posInf || float == Float.negInf)
+      throw IOErr("Unsupported JSON float literal: '${float}'")
+
+    print(float)
+  }
+
   private Void writeJsonNum(Num num)
   {
     print(num)
diff --git a/src/util/test/JsonTest.fan b/src/util/test/JsonTest.fan
index cd7672df6..fc6395043 100644
--- a/src/util/test/JsonTest.fan
+++ b/src/util/test/JsonTest.fan
@@ -115,7 +115,6 @@ class JsonTest : Test
     verifyWrite(["key":"val"], Str<|{"key":"val"}|>)
     verifyWrite(["key":"val\\\"ue"], Str<|{"key":"val\\\"ue"}|>)
 
-
     // simples
     verifyWrite(5min, Str<|"5min"|>)
     verifyWrite(`/some/uri/`, Str<|"/some/uri/"|>)
@@ -128,6 +127,11 @@ class JsonTest : Test
     verifyWrite(SerialA(),
       Str<|{"b":true,"i":7,"f":5.0,"s":"string\n","ints":[1,2,3]}|>)
 
+    // invalid float literals
+    verifyErr(IOErr#) { verifyWrite(Float.nan, "")    }
+    verifyErr(IOErr#) { verifyWrite(Float.posInf, "") }
+    verifyErr(IOErr#) { verifyWrite(Float.negInf, "") }
+
     // errors
     verifyErr(IOErr#) { verifyWrite(Buf(), "") }
     verifyErr(IOErr#) { verifyWrite(Str#.pod, "") }