MOD-7266 make sure to `end()` deserialization, to disallow trailing c… by AvivDavid23 · Pull Request #1554 · RedisJSON/RedisJSON

AvivDavid23 · 2026-04-13T12:38:18Z

…hars

Note

Medium Risk
Changes JSON parsing behavior for JSON.SET/JSON.MERGE (and any path using Manager::from_str) by rejecting inputs with trailing characters, which may break clients that relied on lenient parsing but improves correctness and safety.

Overview
Tightens JSON value parsing by requiring serde_json deserialization to fully consume the input: RedisIValueJsonKeyManager::from_str now calls Deserializer::end() so literals/values with trailing characters are rejected instead of being silently truncated.

Adds a regression test ensuring JSON.SET fails on values like trueabc, {"a":1}x, and 123abc, and fixes a malformed JSON literal in an existing JSON.MERGE nested test.

^{Reviewed by Cursor Bugbot for commit b6ff2ee. Bugbot is set up for automated code reviews on this repo. Configure here.}

…hars

codecov · 2026-04-13T12:46:24Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 75.32%. Comparing base (15d0b92) to head (b6ff2ee).
⚠️ Report is 1 commits behind head on master.

Additional details and impacted files

@@            Coverage Diff             @@
##           master    #1554      +/-   ##
==========================================
+ Coverage   75.30%   75.32%   +0.02%     
==========================================
  Files          15       15              
  Lines        4240     4244       +4     
==========================================
+ Hits         3193     3197       +4     
  Misses       1047     1047

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

TalBarYakar

diasllow -> diasllow

#1554)

* MOD-6722 Fix mutation ordering for array commands with recursive paths (#1543) * MOD-7266 make sure to `end()` deserialization, to disallow trailing c… (#1554) * MOD-14664 Json Path evaluation - Allow multi-result nodelists in filt… (#1542) * MOD-14664 Json Path evaluation - Allow multi-result nodelists in filter comparisons, Don't evaluate filters on scalar types * MOD-7264 | MOD-7270 fmt * tests(for coverage) * Revert "tests(for coverage)" This reverts commit b0668a5.

* Cherry-pick bug fixes to 8.8 (#1557) * MOD-6722 Fix mutation ordering for array commands with recursive paths (#1543) * MOD-7266 make sure to `end()` deserialization, to disallow trailing c… (#1554) * MOD-14664 Json Path evaluation - Allow multi-result nodelists in filt… (#1542) * MOD-14664 Json Path evaluation - Allow multi-result nodelists in filter comparisons, Don't evaluate filters on scalar types * MOD-7264 | MOD-7270 fmt * tests(for coverage) * Revert "tests(for coverage)" This reverts commit b0668a5. * Fix API incompatibilities: use &'j S instead of ValueRef, fix root.clone() Made-with: Cursor * cargo fmt Made-with: Cursor

* MOD-6722 Fix mutation ordering for array commands with recursive paths (#1543) * MOD-7266 make sure to `end()` deserialization, to disallow trailing c… (#1554) * MOD-14664 Json Path evaluation - Allow multi-result nodelists in filt… (#1542) * MOD-14664 Json Path evaluation - Allow multi-result nodelists in filter comparisons, Don't evaluate filters on scalar types * MOD-7264 | MOD-7270 fmt * tests(for coverage) * Revert "tests(for coverage)" This reverts commit b0668a5.

* Cherry-pick bug fixes to 8.8 (#1557) * MOD-6722 Fix mutation ordering for array commands with recursive paths (#1543) * MOD-7266 make sure to `end()` deserialization, to disallow trailing c… (#1554) * MOD-14664 Json Path evaluation - Allow multi-result nodelists in filt… (#1542) * MOD-14664 Json Path evaluation - Allow multi-result nodelists in filter comparisons, Don't evaluate filters on scalar types * MOD-7264 | MOD-7270 fmt * tests(for coverage) * Revert "tests(for coverage)" This reverts commit b0668a5. * Fix API incompatibilities: use &'j S instead of ValueRef, fix root.clone(), fix error type annotation Made-with: Cursor * cargo fmt Made-with: Cursor

* Cherry-pick bug fixes to 8.8 (#1557) * MOD-6722 Fix mutation ordering for array commands with recursive paths (#1543) * MOD-7266 make sure to `end()` deserialization, to disallow trailing c… (#1554) * MOD-14664 Json Path evaluation - Allow multi-result nodelists in filt… (#1542) * MOD-14664 Json Path evaluation - Allow multi-result nodelists in filter comparisons, Don't evaluate filters on scalar types * MOD-7264 | MOD-7270 fmt * tests(for coverage) * Revert "tests(for coverage)" This reverts commit b0668a5. * Fix API incompatibilities: use &'j S instead of ValueRef, fix root.clone() Made-with: Cursor * cargo fmt Made-with: Cursor

* Cherry-pick bug fixes to 8.8 (#1557) * MOD-6722 Fix mutation ordering for array commands with recursive paths (#1543) * MOD-7266 make sure to `end()` deserialization, to disallow trailing c… (#1554) * MOD-14664 Json Path evaluation - Allow multi-result nodelists in filt… (#1542) * MOD-14664 Json Path evaluation - Allow multi-result nodelists in filter comparisons, Don't evaluate filters on scalar types * MOD-7264 | MOD-7270 fmt * tests(for coverage) * Revert "tests(for coverage)" This reverts commit b0668a5. * Fix API incompatibilities: use &'j S instead of ValueRef, fix root.clone(), fix error type annotation Made-with: Cursor * cargo fmt Made-with: Cursor * Remove test_filter_null: null literal not supported in 2.4 parser grammar The 2.4 jsonpath grammar predates null literal support in filter expressions, causing QueryCompilationError for "$[?(@==null)]". Made-with: Cursor * Fix 2.4 test failures: apply MOD-6722 mutation ordering and remove crashing tests - Apply compare_paths_for_mutation to src/commands.rs (arr_insert/pop/trim impl and legacy functions) — the mutation ordering fix was never ported to 2.4's src/commands.rs during the initial cherry-pick - Force rebuild exposed stale binary for MOD-7266 (deserializer.end()); the fix was already in src/ivalue_manager.rs but the old .dylib predated it - Add test for trailing-char rejection in ivalue_manager unit tests - Remove test_recursive_descent: JSON.SET with $..* wildcard crashes 2.4's server (pre-existing bug unrelated to this cherry-pick) Made-with: Cursor * Fix serde_value_manager: add deserializer.end() to reject trailing chars (MOD-7266) Made-with: Cursor

* Cherry-pick bug fixes to 8.8 (#1557) * MOD-6722 Fix mutation ordering for array commands with recursive paths (#1543) * MOD-7266 make sure to `end()` deserialization, to disallow trailing c… (#1554) * MOD-14664 Json Path evaluation - Allow multi-result nodelists in filt… (#1542) * MOD-14664 Json Path evaluation - Allow multi-result nodelists in filter comparisons, Don't evaluate filters on scalar types * MOD-7264 | MOD-7270 fmt * tests(for coverage) * Revert "tests(for coverage)" This reverts commit b0668a5. * Fix API incompatibilities: use &'j S instead of ValueRef, fix root.clone(), fix error type annotation Made-with: Cursor * cargo fmt Made-with: Cursor

JSON - 8.7.91: * Cherry-pick bug fixes to 8.8 (RedisJSON/RedisJSON#1557) * MOD-6722 Fix mutation ordering for array commands with recursive paths (RedisJSON/RedisJSON#1543) * MOD-7266 make sure to end() deserialization, to disallow trailing c… (RedisJSON/RedisJSON#1554) * MOD-14664 Json Path evaluation - Allow multi-result nodelists in filt… (RedisJSON/RedisJSON#1542) Bloom - 8.7.91 * Lili: RED-180951 RED-181297 RED-184457 RED-184456 RED-184458 RED-184459 fixing bugs and improving the code (RedisBloom/RedisBloom#1002) * MOD-14675 - refresh os list to 8.8 (RedisBloom/RedisBloom#976) Time Series - 8.7.91: * MOD-15262 - Align TimeSeries with the RedisModule_GetUserUserName API… (RedisTimeSeries/RedisTimeSeries#1985) * MOD-14420 fix count reducers return wrong NaN (RedisTimeSeries/RedisTimeSeries#2013) (RedisTimeSeries/RedisTimeSeries#2016) * Lili- RED-180951 RED-180027 fixing bugs and improving the code (RedisTimeSeries/RedisTimeSeries#2003) * MOD-14674 - refresh os list to 8.8 (RedisTimeSeries/RedisTimeSeries#1946)

MOD-7266 make sure to end() deserialization, to diasllow trailing c…

7bb5bcf

…hars

AvivDavid23 mentioned this pull request Apr 13, 2026

Any literal that starts with true/false/null is considered valid and interpreted as true/false/null #976

Closed

TalBarYakar previously approved these changes Apr 13, 2026

View reviewed changes

AvivDavid23 changed the title ~~MOD-7266 make sure to end() deserialization, to diasllow trailing c…~~ MOD-7266 make sure to end() deserialization, to disallow trailing c… Apr 13, 2026

fix testMergeNested

b6ff2ee

AvivDavid23 dismissed TalBarYakar’s stale review via b6ff2ee April 13, 2026 13:19

TalBarYakar approved these changes Apr 13, 2026

View reviewed changes

AvivDavid23 merged commit c9ef219 into master Apr 14, 2026
60 of 62 checks passed

AvivDavid23 deleted the MOD-7266 branch April 14, 2026 05:19

AvivDavid23 added a commit that referenced this pull request Apr 14, 2026

MOD-7266 make sure to end() deserialization, to disallow trailing c… (

92447f8

#1554)

AvivDavid23 mentioned this pull request Apr 14, 2026

Cherry-pick bug fixes to 8.8 #1557

Merged

gabsow mentioned this pull request May 13, 2026

updating Data Types to RC1 redis/redis#15201

Merged

AvivDavid23 mentioned this pull request Jun 24, 2026

Update RedisJSON to version 8.9.80 redis/redis#15363

Merged

4 tasks

Navigation Menu

Uh oh!

MOD-7266 make sure to `end()` deserialization, to disallow trailing c… - #1554

MOD-7266 make sure to `end()` deserialization, to disallow trailing c…#1554
AvivDavid23 merged 2 commits into
masterfrom
MOD-7266

AvivDavid23 commented Apr 13, 2026 •

edited by cursor Bot

Loading

Uh oh!

codecov Bot commented Apr 13, 2026 •

edited

Loading

Uh oh!

TalBarYakar left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

AvivDavid23 commented Apr 13, 2026 • edited by cursor Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

codecov Bot commented Apr 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

TalBarYakar left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

AvivDavid23 commented Apr 13, 2026 •

edited by cursor Bot

Loading

codecov Bot commented Apr 13, 2026 •

edited

Loading