Skip to content

fix(acl): map NaN/\u00b1Infinity to JSON null instead of panicking#15482

Open
thanhtoantnt wants to merge 1 commit into
tauri-apps:devfrom
thanhtoantnt:fix/acl-nonfinite-float-panic
Open

fix(acl): map NaN/\u00b1Infinity to JSON null instead of panicking#15482
thanhtoantnt wants to merge 1 commit into
tauri-apps:devfrom
thanhtoantnt:fix/acl-nonfinite-float-panic

Conversation

@thanhtoantnt

Copy link
Copy Markdown
Contributor

closes #15477

What changed

From for serde_json::Value in crates/tauri-utils/src/acl/value.rs was calling serde_json::Number::from_f64(f).unwrap(). The JSON spec (RFC 8259 §6) does not permit non-finite
floats, so from_f64 returns None for NaN, +Infinity, and -Infinity — and the .unwrap() turns that into an unconditional panic.

  // before — panics for non-finite f64
  Value::Number(Number::Float(f)) => {
      serde_json::Value::Number(serde_json::Number::from_f64(f).unwrap())
  }

  // after — non-finite maps to null
  Value::Number(Number::Float(f)) => {
      match serde_json::Number::from_f64(f) {
          Some(n) => serde_json::Value::Number(n),
          None => serde_json::Value::Null, // NaN / ±Infinity are not valid JSON
      }
  }

Number::Float accepts any f64 via From, so non-finite values are constructible without error and the panic was the first signal that anything was wrong — potentially surfacing
at an unrelated call site well after the bad value was created.

Non-finite floats now produce serde_json::Value::Null, consistent with the IEEE 754 null-substitution convention used by many JSON serializers.

From<Value> for serde_json::Value was calling
serde_json::Number::from_f64(f).unwrap(), which panics for non-finite
f64 values (NaN, +Infinity, -Infinity) because the JSON spec (RFC 8259)
does not permit them.

Replace the unwrap with an explicit match: finite floats produce a JSON
Number as before; non-finite values produce JSON null, matching the
IEEE 754 null-substitution convention used by many JSON serializers.

Fixes tauri-apps#15477
@thanhtoantnt thanhtoantnt requested a review from a team as a code owner June 5, 2026 02:36
Value::Bool(b) => serde_json::Value::Bool(b),
Value::Number(Number::Float(f)) => {
serde_json::Value::Number(serde_json::Number::from_f64(f).unwrap())
match serde_json::Number::from_f64(f) {

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

As much as this is a problem, from how we use this today, a crash might be better than silently making it null here.

@Legend-Master Legend-Master added the status: waiting Waiting on author label Jun 11, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

status: waiting Waiting on author

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[bug] Panic on inf/-inf/NaN floats when converting acl::Value to serde_json::Value

2 participants