Added checking and tests for trailing garbage when decoding

json.lua

@@ -388,7 +388,12 @@ function json.decode(str)
   if type(str) ~= "string" then
     error("expected argument of type string, got " .. type(str))
   end
-  return ( parse(str, next_char(str, 1, space_chars, true)) )
+  local res, idx = parse(str, next_char(str, 1, space_chars, true))
+  idx = next_char(str, idx, space_chars, true)
+  if idx <= #str then
+    decode_error(str, idx, "trailing garbage")
+  end
+  return res
 end
 
 

test/test.lua

@@ -57,7 +57,7 @@ end)
 
 test("literals", function()
   assert( json.decode("true") == true )
-  assert( json.encode(true) == "true" ) 
+  assert( json.encode(true) == "true" )
   assert( json.decode("false") == false )
   assert( json.encode(false) == "false" )
   assert( json.decode("null") == nil )
@@ -125,6 +125,8 @@ test("decode invalid", function()
     '{]',
     '[}',
     '"a',
+    '10 xx',
+    '{}123'
   }
   for i, v in ipairs(t) do
     local status = pcall(json.decode, v)
@@ -234,5 +236,3 @@ test("encode escape", function()
     assert( res == v, fmt("'%s' was not escaped properly", k) )
   end
 end)
-
-