Hacker News new | past | comments | ask | show | jobs | submit login

Some parsers, like PHP, may treat 65537 and "65537" the same. Room for vulnerability.



Why would they do so? It's semantically distinct JSON, even JS itself treats it differently?


Time for a trip to the Abbey of Hidden Absurdities.

http://www.thecodelesscode.com/case/161


It's PHP. Handling numbers in PHP is complicated enough that a reasonable person would not trust it by default.

https://www.php.net/manual/en/language.types.numeric-strings...


I know that PHP will treat a string as if it were a number if you try to use it in a context where number is expected; JS does the same thing. But why would that affect JSON deserialization in a way that makes numbers and strings indistinguishable in principle (causing the loss of precision as described here)?




Consider applying for YC's Fall 2025 batch! Applications are open till Aug 4

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: