fix(transcript): a JSON member is found with the whitespace JSON allows - #21
Merged
Merged
Conversation
GitHub pretty-prints its identity response for the media type the profile pins: a space after every colon, a newline and an indent before every key. The finders matched `\"login\":\"` and `\"id\":` byte for byte, so no layout for a real GitHub identity read could be built, and the same template the verifier refused was refused here first, with the reason invisible. The key, then a colon, then the value, with JSON whitespace allowed on either side of the colon and before an integer's terminator. The whitespace is inside the member: the verifier reads the revealed range as the wire carried it and removes the whitespace beside structure itself before comparing, so the range has to carry it. A key that is only another member's value is passed over, as the old template passed it over. `123 4` is still not a number. The verifier side is libid-org/libID-contracts#37. Assisted-by: Claude Opus 5 Signed-off-by: xgreenx <xgreenx9999@gmail.com>
The quoted member and the bare integer each walked the body for `"field"` followed by a colon with a copy of the same loop; `key_and_value` is that loop once, handing back the key's opening quote and the value's first byte. The doc on `find_json_snippet_range` still argued for the compact template the reader no longer requires; it now argues for the allowance the reader's whitespace removal maps onto the literal. Tests carried over from #20: every RFC 8259 whitespace byte alone and as a run on both sides of the colon and before the terminator, the bytes JSON does not call whitespace (VT, FF), a number of another shape, chunk framing that lands inside the whitespace, and the token response's delimiter revealed with its whitespace while the bearer alone is committed. Co-authored-by: Wondertan <hlibwondertan@gmail.com> Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Signed-off-by: xgreenx <xgreenx9999@gmail.com>
Merged
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
GitHub pretty-prints
/userfor the media type the profile pins (accept: application/vnd.github+json; checked live, the JSON is compact without it), so the finders matching"login":"and"id":byte for byte could build no layout for a real identity read.JsonMember::in_bodyandfind_json_bare_snippet_rangenow accept JSON whitespace (0x20 0x09 0x0a 0x0d) between the key and the colon, between the colon and the value, and before an integer's terminator, and keep it inside the member's range: the verifier reads the revealed range as the wire carried it and removes the whitespace beside structural bytes itself before comparing (libid-org/libID-contracts#37), so the range has to carry it. A key that is only another member's value is passed over, as before;123 4is still not a number.Tests: the pretty-printed member and integer are found with their whitespace inside; a value that spells the key is passed over; whitespace inside a number yields nothing; and the GitHub identity layout over the response GitHub actually serves reveals
"login": "octocat"and"id": 583231,as ranges.🤖 Generated with Claude Code