Fixes corner case where strict mode isn't working when JSONTokener's next() and back() are called first

Author: XIAYM-gh

src/main/java/org/json/JSONArray.java

@@ -94,9 +94,21 @@ public JSONArray(JSONTokener x) throws JSONException {
      * @throws JSONException If a syntax error occurs during the construction of the JSONArray.
      */
     public JSONArray(JSONTokener x, JSONParserConfiguration jsonParserConfiguration) throws JSONException {
+        this(x, jsonParserConfiguration, x.isAtStart());
+    }
+
+    /**
+     * Constructs a JSONArray from a JSONTokener and a JSONParserConfiguration, for internal use. <br>
+     * Never call this instead of using withStrictMode(boolean).
+     *
+     * @param x                       A JSONTokener instance from which the JSONArray is constructed.
+     * @param jsonParserConfiguration A JSONParserConfiguration instance that controls the behavior of the parser.
+     * @param eofRequired             A boolean that determines whether this array is the root.
+     * @throws JSONException If a syntax error occurs during the construction of the JSONArray.
+     */
+    JSONArray(JSONTokener x, JSONParserConfiguration jsonParserConfiguration, boolean eofRequired) throws JSONException {
         this();
 
-        boolean isInitial = x.getPrevious() == 0;
         if (x.nextClean() != '[') {
             throw x.syntaxError("A JSONArray text must start with '['");
         }
@@ -118,10 +130,10 @@ public JSONArray(JSONTokener x, JSONParserConfiguration jsonParserConfiguration)
                     x.back();
                     this.myArrayList.add(x.nextValue());
                 }
-                if (checkForSyntaxError(x, jsonParserConfiguration, isInitial)) return;
+                if (checkForSyntaxError(x, jsonParserConfiguration, eofRequired)) return;
             }
         } else {
-            if (isInitial && jsonParserConfiguration.isStrictMode() && x.nextClean() != 0) {
+            if (eofRequired && jsonParserConfiguration.isStrictMode() && x.nextClean() != 0) {
                 throw x.syntaxError("Strict mode error: Unparsed characters found at end of input text");
             }
         }

src/main/java/org/json/JSONObject.java

@@ -214,14 +214,31 @@ public JSONObject(JSONTokener x) throws JSONException {
      *             duplicated key.
      */
     public JSONObject(JSONTokener x, JSONParserConfiguration jsonParserConfiguration) throws JSONException {
+        this(x, jsonParserConfiguration, x.isAtStart());
+    }
+
+    /**
+     * Construct a JSONObject from a JSONTokener with custom json parse configurations, for internal use. <br>
+     * Never call this instead of using withStrictMode(boolean).
+     *
+     * @param x
+     *            A JSONTokener object containing the source string.
+     * @param jsonParserConfiguration
+     *            Variable to pass parser custom configuration for json parsing.
+     * @param eofRequired
+     *            A boolean that determines whether this object is the root.
+     * @throws JSONException
+     *             If there is a syntax error in the source string or a
+     *             duplicated key.
+     */
+    JSONObject(JSONTokener x, JSONParserConfiguration jsonParserConfiguration, boolean eofRequired) throws JSONException {
         this();
-        boolean isInitial = x.getPrevious() == 0;
 
         if (x.nextClean() != '{') {
             throw x.syntaxError("A JSONObject text must begin with '{'");
         }
         for (;;) {
-            if (parseJSONObject(x, jsonParserConfiguration, isInitial)) {
+            if (parseJSONObject(x, jsonParserConfiguration, eofRequired)) {
                 return;
             }
         }

src/main/java/org/json/JSONTokener.java

@@ -120,6 +120,15 @@ public void setJsonParserConfiguration(JSONParserConfiguration jsonParserConfigu
         this.jsonParserConfiguration = jsonParserConfiguration;
     }
 
+    /**
+     * Returns whether the tokener is currently positioned at the beginning,
+     *
+     * @return true if the current input position is the beginning
+     */
+    public boolean isAtStart() {
+        return this.index == 0;
+    }
+
     /**
      * Back up one character. This provides a sort of lookahead capability,
      * so that you can test for a digit or letter before attempting to parse
@@ -458,14 +467,14 @@ public Object nextValue() throws JSONException {
         case '{':
             this.back();
             try {
-                return new JSONObject(this, jsonParserConfiguration);
+                return new JSONObject(this, jsonParserConfiguration, false);
             } catch (StackOverflowError e) {
                 throw new JSONException("JSON Array or Object depth too large to process.", e);
             }
         case '[':
             this.back();
             try {
-                return new JSONArray(this, jsonParserConfiguration);
+                return new JSONArray(this, jsonParserConfiguration, false);
             } catch (StackOverflowError e) {
                 throw new JSONException("JSON Array or Object depth too large to process.", e);
             }

src/test/java/org/json/junit/JSONArrayTest.java

@@ -1566,4 +1566,22 @@ public void TestLenientCommas() {
                     "[1,null,3]", jsonArray.toString());
         }
     }
+
+    @Test
+    public void strictModeShouldCheckTrailingCharactersAfterNextAndBack() {
+        JSONParserConfiguration strict =
+                new JSONParserConfiguration().withStrictMode();
+
+        JSONTokener tok = new JSONTokener("[]xxx");
+
+        tok.next();
+        tok.back();
+
+        JSONException exception = assertThrows(
+                JSONException.class,
+                () -> new JSONArray(tok, strict));
+
+        assertTrue(exception.getMessage().contains(
+                "Unparsed characters found at end of input text"));
+    }
 }

src/test/java/org/json/junit/JSONObjectTest.java

@@ -4337,4 +4337,22 @@ public void testStringToNumberInvalidFormats() {
 		}
 	}
 
+	@Test
+	public void strictModeShouldCheckTrailingCharactersAfterNextAndBack() {
+		JSONParserConfiguration strict =
+				new JSONParserConfiguration().withStrictMode();
+
+		JSONTokener tok = new JSONTokener("{}xxx");
+
+		tok.next();
+		tok.back();
+
+		JSONException exception = assertThrows(
+				JSONException.class,
+				() -> new JSONObject(tok, strict));
+
+		assertTrue(exception.getMessage().contains(
+				"Unparsed characters found at end of input text"));
+	}
+
 }