Merge pull request #19 from colinodell/fix-unpaired-surrogate-detection

Throw exception for unpaired UTF-16 surrogates

Author: colinodell

CHANGELOG.md

@@ -8,6 +8,7 @@ Updates should follow the [Keep a CHANGELOG](http://keepachangelog.com/) princip
 
 ### Fixed
  - Fixed "small" integers always being cast to strings when `JSON_BIGINT_AS_STRING` is set (#17)
+ - Fixed exceptions not being thrown when invalid UTF-16 escape sequences are encountered in strings
 
 ## [2.2.1] - 2021-11-06
 ### Fixed

src/Json5Decoder.php

@@ -324,7 +324,15 @@ private function string()
 
             if ($this->currentByte === '\\') {
                 if ($this->peek() === 'u' && $unicodeEscaped = $this->match('/^(?:\\\\u[A-Fa-f0-9]{4})+/')) {
-                    $string .= \json_decode('"'.$unicodeEscaped.'"');
+                    try {
+                        $unicodeUnescaped = \json_decode('"' . $unicodeEscaped . '"', false, 1, JSON_THROW_ON_ERROR);
+                        if ($unicodeUnescaped === null && ($err = json_last_error_msg())) {
+                            throw new \JsonException($err);
+                        }
+                        $string .= $unicodeUnescaped;
+                    } catch (\JsonException $e) {
+                        $this->throwSyntaxError($e->getMessage());
+                    }
                     continue;
                 }
 

test/Functional/data/unicode/unicode-unpaired-surrogate.errorSpec

@@ -0,0 +1,5 @@
+{
+    "lineNumber": 1,
+    "columnNumber": 24,
+    "message": "Single unpaired UTF-16 surrogate in unicode escape",
+}

test/Functional/data/unicode/unicode-unpaired-surrogate.txt

@@ -0,0 +1 @@
+{"test": 1, "test\ud800": 2}