JsonWriter: Write non-finite floating-point values as strings#4080
JsonWriter: Write non-finite floating-point values as strings#4080
Conversation
This change updates `JsonWriter` to serialize non-finite `float` and `double` values (`NaN`, `Infinity`, and `-Infinity`) as JSON strings. This behavior aligns with Jackson's `JsonWriteFeature#WRITE_NAN_AS_STRINGS`. Previously, these values were written without quotes, which produces **invalid JSON** according to the JSON specification.
There was a problem hiding this comment.
Pull request overview
Updates JsonWriter so that non-finite floating-point values (NaN, Infinity, -Infinity) are serialized as JSON strings, producing valid JSON output and aligning behavior with Jackson’s JsonWriteFeature#WRITE_NAN_AS_STRINGS.
Changes:
- Serialize non-finite
float/doublevalues as quoted strings inJsonWriter. - Add parameterized tests covering non-finite
float/doubleserialization. - Add a changelog entry documenting the fix.
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
src/changelog/.2.x.x/4080_jtl-nan.xml |
Adds changelog entry for the non-finite float/double JSON serialization fix. |
log4j-layout-template-json/.../JsonWriter.java |
Writes non-finite float/double values via writeString(...) instead of emitting invalid JSON numbers. |
log4j-layout-template-json-test/.../JsonWriterTest.java |
Adds parameterized tests asserting non-finite values are quoted. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
|
Thanks for the fix. Ironically, it would have gained much less recognition if NIST hadn't assigned a 7.5 HIGH CVSS 3.1 score to CVE-2026-34481 (CVSS 4.0 is 6.3 MEDIUM). |
|
Hi @marcelstoer, Sorry about that! 😉 We intentionally published a CVSS 4.0 score, to prevent CISA from providing its own and blowing this out of proportion. Unfortunately NVD “enriches” the records independently by:
Since NVD is basically not operational, maybe you can convince your organization to source vulnerability records directly from the CVE database or GitHub Advisories? Not that the latter currently imports from NVD, so we had to manually improve the GitHub Advisories entry, which increased the delay between the disclosure and the availability of the data. |
|
No need to be sorry about this. You did what you could and I sure do appreciate that.
I'm involved with the OWASP Dependency Check project. We use it heavily at my org.
I have been through that process a couple of times myself. It's a huge benefit that the GHSA program accepting PRs for their entries. |
This change updates
JsonWriterto serialize non-finitefloatanddoublevalues (NaN,Infinity, and-Infinity) as JSON strings.This behavior aligns with Jackson's
JsonWriteFeature#WRITE_NAN_AS_STRINGS.Previously, these values were written without quotes, which produces invalid JSON according to the JSON specification.