Python implementation of json.loads() accepts non-ascii digits

[nineteendo]

Bug report

Bug description:

You should be careful when matching unicode regexes:

cpython/Lib/json/scanner.py

Lines 11 to 13 in a0f5c8e

	NUMBER_RE = re.compile(
	r'(-?(?:0|[1-9]\d*))(\.\d+)?([eE][-+]?\d+)?',
	(re.VERBOSE | re.MULTILINE | re.DOTALL))

>>> import sys
>>> sys.modules["_json"] = None
>>> import json
>>> json.loads("[1\uff10, 0.\uff10, 0e\uff10]")
[10, 0.0, 0.0]

I think it's safer to use [0-9] instead of \d here.

CPython versions tested on:

3.13

Operating systems tested on:

macOS

Linked PRs

• gh-125682: Python implementation of json.loads() accepts non-ascii digits #125687
• [3.13] gh-125682: Reject non-ASCII digits in the Python implementation of JSON decoder (GH-125687) #125692
• [3.12] gh-125682: Reject non-ASCII digits in the Python implementation of JSON decoder (GH-125687) #125693

[ZeroIntensity]

Why is this a bug? int and float support this as well:

>>> int("\uff10")
0
>>> float("0e\uff10")
0.0

Arguably, the bug is that the C implementation does not support it.

[taleinat]

This can indeed be considered a bug, since it does not conform to the JSON specification in the standards.

See, for example, Section 6: Numbers in IETF RFC 8259, which clearly defines the supported digits.

[ZeroIntensity]

Ah, I've applied the appropriate labels. Thank you for clarification :)

[hauntsaninja]

Good spot!