From 57f89b3630f64dc5d13266761d4100acd0d50438 Mon Sep 17 00:00:00 2001
From: Simon Halvorsen <simon.halvorsen@northern.tech>
Date: Thu, 25 Jun 2026 16:07:07 +0200
Subject: [PATCH] ENT-14036: Fixed a bug with json-parse not failing on missing
 comma

Ticket: ENT-14036
Changelog: None

Signed-off-by: Simon Halvorsen <simon.halvorsen@northern.tech>
---
 libutils/json.c        |  7 +++++++
 libutils/json.h        |  1 +
 tests/unit/json_test.c | 39 +++++++++++++++++++++++++++++++++++++++
 3 files changed, 47 insertions(+)

diff --git a/libutils/json.c b/libutils/json.c
index 42f41263..e46e0716 100644
--- a/libutils/json.c
+++ b/libutils/json.c
@@ -2157,6 +2157,8 @@ const char *JsonParseErrorToString(const JsonParseError error)
             "Unable to parse json data as object, ':' seen without having specified an l-value",
         [JSON_PARSE_ERROR_OBJECT_COMMA] =
             "Unable to parse json data as object, ',' seen without having specified an r-value",
+        [JSON_PARSE_ERROR_OBJECT_COMMA_MISSING] =
+            "Unable to parse json data as object, new key started without preceding ','",
         [JSON_PARSE_ERROR_OBJECT_ARRAY_LVAL] =
             "Unable to parse json data as object, array not allowed as l-value",
         [JSON_PARSE_ERROR_OBJECT_OBJECT_LVAL] =
@@ -2670,6 +2672,11 @@ static JsonParseError JsonParseAsObject(
             }
             else
             {
+                if (prev_char != '{' && prev_char != ',')
+                {
+                    JsonDestroy(object);
+                    return JSON_PARSE_ERROR_OBJECT_COMMA_MISSING;
+                }
                 property_name = NULL;
                 JsonParseError err = JsonParseAsString(data, &property_name);
                 if (err != JSON_PARSE_OK)
diff --git a/libutils/json.h b/libutils/json.h
index e42d7fa0..fd0faa8c 100644
--- a/libutils/json.h
+++ b/libutils/json.h
@@ -106,6 +106,7 @@ typedef enum
     JSON_PARSE_ERROR_OBJECT_END,
     JSON_PARSE_ERROR_OBJECT_COLON,
     JSON_PARSE_ERROR_OBJECT_COMMA,
+    JSON_PARSE_ERROR_OBJECT_COMMA_MISSING,
     JSON_PARSE_ERROR_OBJECT_ARRAY_LVAL,
     JSON_PARSE_ERROR_OBJECT_OBJECT_LVAL,
     JSON_PARSE_ERROR_OBJECT_OPEN_LVAL,
diff --git a/tests/unit/json_test.c b/tests/unit/json_test.c
index f93c83a0..200478a8 100644
--- a/tests/unit/json_test.c
+++ b/tests/unit/json_test.c
@@ -2449,6 +2449,44 @@ static void test_json_get_type_as_string()
     }
 }
 
+static void test_json_parse_object_missing_comma(void)
+{
+    {
+        const char *data =
+            "{ \"first\": \"one\" \"second\": \"two\" }";
+        JsonElement *json = NULL;
+        assert_int_not_equal(JSON_PARSE_OK, JsonParse(&data, &json));
+        assert_false(json);
+    }
+
+    {
+        const char *data =
+            "{\"first\":\"one\"\"second\":\"two\"}";
+        JsonElement *json = NULL;
+        assert_int_not_equal(JSON_PARSE_OK, JsonParse(&data, &json));
+        assert_false(json);
+    }
+
+    {
+        const char *data =
+            "{ \"first\": \"one\", \"second\": \"two\" \"third\": \"three\" }";
+        JsonElement *json = NULL;
+        assert_int_not_equal(JSON_PARSE_OK, JsonParse(&data, &json));
+        assert_false(json);
+    }
+
+    {
+        const char *data =
+            "{ \"first\": \"one\", \"second\": \"two\" }";
+        JsonElement *json = NULL;
+        assert_int_equal(JSON_PARSE_OK, JsonParse(&data, &json));
+        assert_true(json);
+        assert_string_equal(JsonObjectGetAsString(json, "first"), "one");
+        assert_string_equal(JsonObjectGetAsString(json, "second"), "two");
+        JsonDestroy(json);
+    }
+}
+
 int main()
 {
     PRINT_TEST_BANNER();
@@ -2521,6 +2559,7 @@ int main()
         unit_test(test_json_object_merge_deep),
         unit_test(test_compare_container_type_mismatch),
         unit_test(test_json_get_type_as_string),
+        unit_test(test_json_parse_object_missing_comma),
     };
 
     return run_tests(tests);