encoding/json: cannot unmarshal zero-padded number string into int under goexperiment.jsonv2

[SunRunAway]

Go version

go version go1.25.1 darwin/arm64

Output of go env in your module/workspace:

AR='ar'
CC='cc'
CGO_CFLAGS='-O2 -g'
CGO_CPPFLAGS=''
CGO_CXXFLAGS='-O2 -g'
CGO_ENABLED='1'
CGO_FFLAGS='-O2 -g'
CGO_LDFLAGS='-O2 -g'
CXX='c++'
GCCGO='gccgo'
GO111MODULE=''
GOARCH='arm64'
GOARM64='v8.0'
GOAUTH='netrc'
GOBIN=''
GOCACHEPROG=''
GODEBUG=''
GOEXE=''
GOEXPERIMENT=''
GOFIPS140='off'
GOFLAGS=''
GOGCCFLAGS='-fPIC -arch arm64 -pthread -fno-caret-diagnostics -Qunused-arguments -fmessage-length=0 -ffile-prefix-map=/var/folders/_8/68c835ts3bs0kz2sr00prn_w0000gn/T/go-build3484535565=/tmp/go-build -gno-record-gcc-switches -fno-common'
GOHOSTARCH='arm64'
GOHOSTOS='darwin'
GOINSECURE=''
GOMOD='/tmp/2/go.mod'
GONOPROXY=''
GONOSUMDB=''
GOOS='darwin'
GOPRIVATE=''
GOPROXY='https://proxy.golang.org,direct'
GOROOT='/opt/homebrew/Cellar/go/1.25.1/libexec'
GOSUMDB='sum.golang.org'
GOTELEMETRY='local'
GOTMPDIR=''
GOTOOLCHAIN='auto'
GOTOOLDIR='/opt/homebrew/Cellar/go/1.25.1/libexec/pkg/tool/darwin_arm64'
GOVCS=''
GOVERSION='go1.25.1'
GOWORK=''
PKG_CONFIG='pkg-config'

What did you do?

run this code with GOEXPERIMENT='jsonv2'

package main

import (
        "encoding/json"
        "fmt"
)

func main() {
        var resp struct {
                Code int `json:"code,string"`
        }
        b := []byte(`{"code": "00012"}`)

        err := json.Unmarshal(b, &resp)
        fmt.Println(err)
}

What did you see happen?

GOEXPERIMENT='jsonv2' go run main.go                                                                                                                                                            06:03:55 PM
json: cannot unmarshal JSON number 00012 into .code of Go type int

GOEXPERIMENT='' go run main.go                                                                                                                                                                  <nil>

What did you expect to see?

both no error as previous go version

[gabyhelp]

Related Issues

• encoding/json: wrong type name used in UnmarshalTypeError #68941 (closed)
• encoding/json: json.Valid([]byte("1")) should be false #66739 (closed)
• encoding/json: Number no longer accepts invalid numbers #37515 (closed)
• encoding/json: wrong encoding for json.Number field with string option (struct tag) #34268 (closed)
• encoding/json: nested unmarshaling mangles errors #68750 (closed)
• affected/package: encoding/json #58511 (closed)
• encoding/json: wrong encoding for string field with integer option (struct tag) #41134 (closed)
• affected/package: #55102 (closed)
• encoding/json: unexpected slice type encoding result #73018 (closed)
• encoding/json: The result has been changed even an error happened at json.Unmarshal #35454 (closed)

_{(Emoji vote if this was helpful or unhelpful; more detailed feedback welcome in this discussion.)}

[JunyangShao]

@rsc @dsnet

[dsnet]

Thank you for the bug report.

Wow... this is a bug in the v1 implementation. According to RFC 8259, section 6, the grammatical construction for an integer is:

int = zero / ( digit1-9 *DIGIT )

In particular, this clearly rejects leading zeros.

That being said, we probably need to replicate this buggy behavior for the v1 emulation.

[SunRunAway]

Thank you for the bug report.

Wow... this is a bug in the v1 implementation. According to RFC 8259, section 6, the grammatical construction for an integer is:

int = zero / ( digit1-9 *DIGIT )

In particular, this clearly rejects leading zeros.

That being said, we probably need to replicate this buggy behavior for the v1 emulation.

The current implementation of Go will raise an error when encountering the number 00012, but it does not report an error when "00012" is used with a string struct tag. It doesn’t seem to violate the RFC specification, right? After all, the string struct tag is Go’s own definition; it simply converts a valid string into an int.

[dsnet]

I'm aware, but with the string struct tag, the intent is that the number quoted within the JSON string is still parsed according to the grammar for a JSON number. So allowing padded zeros is incorrect.

[seankhliao]

can't this be fixed as a bug in v1?
allowed inputs have been tightened before, e.g. in #14702, I don't think the standard library has to carry bugs forward forever

[dsnet]

While #14072 did change the behavior and eventually made the decision to stick with it...

• That decision was made 5 years ago and we have become increasingly more risk adverse to making disruptive changes as time goes on. There is probably 2-3x more Go code today than back then, increasing the number of potential reported breakages compared to back then.
• That issue was with regard to changing json.Number, which is relatively less used (156k occurrences) compared to use of the string tag on a Go number (356k occurrences), further increasing the probability of reported breakages.
• Also, the number of complaints on encoding/json: Unmarshal into struct field or a map does not validate invalid json.Number #14702 and encoding/json: document change in Number behavior for 1.14 #37308 that this change broke them is indicative that it was a relatively disruptive change. If it was disruptive back then, I suspect this will be even more disruptive today.

I'm not opposed to just fixing this bug (i.e., let a future release of Go "break" this behavior), but I think we should make an honest effort at seeing how much cost it would take to actually make the v1 emulation replicate the behavior.

[mvdan]

As the person who was involved in the earlier change and its fallout, I agree with Joe's points above.

I will add a fourth; the previous bug was much worse than this one in my opinion. "foobar" decoding into json.Number without error is pretty silly. "0012" decoding into int json:`,string` without error is not intended, but doesn't seem as dangerous.

Which also makes me think the number of users of this edge case is likely higher than we might imagine.