What the developer wrote
Authored by Lagrang3
lighting-cli: fix invalid json
Changelog-Fixed: lightning-cli: fix invalid json requests when input includes a numeric string with leading zeroes
Signed-off-by: Lagrang3 <lagrang3@protonmail.com>
What changed, and why it matters
This commit fixes a bug in the lightning-cli command-line tool. Previously, if a user typed a numeric string starting with zero (like '0123'), the tool would send it to the lightningd server as a bare number. In JSON, numbers with leading zeros are invalid, so plugins written in Rust or Python could crash when parsing the request. The fix forces such strings to be quoted, making them valid JSON strings instead of invalid numbers. A previously-skipped test that checks for valid JSON from the CLI is re-enabled.
Treat this as a low-severity reliability/robustness fix. No immediate security response is required, but users and integrators should update to avoid RPC failures or plugin crashes when passing zero-padded numeric strings via lightning-cli. Review other CLI argument literalization rules for similar JSON validity edge cases.
Security signals we found
Input validation bug in CLI argument parsing
Generated invalid JSON for numeric strings with leading zeros
Could cause downstream RPC consumers/plugins to crash on malformed input
Regression test re-enabled after fix
Evidence from the diff
In cli/lightning-cli.c, the is_literal() function decides whether a CLI argument should be passed as a JSON literal (unquoted) or as a JSON string (quoted). The old logic treated any digit string as a numeric literal, including strings with leading zeros (e.g., ‘0123’, ‘00’). JSON (RFC 8259) does not allow leading zeros in numbers, so these produced invalid JSON. The patch adds an explicit guard: if the argument is all digits, longer than one character, and starts with ‘0’, it is not treated as a literal and will be quoted. The commit also removes a @pytest.mark.skip decorator from test_valid_json_cli in tests/test_misc.py, re-enabling regression coverage.
Changed components
cli/lightning-cli.ctests/test_misc.pyInspect captured patch +7 / −1
diff --git a/cli/lightning-cli.c b/cli/lightning-cli.c
index 3aed5362..dee4c124 100644
--- a/cli/lightning-cli.c
+++ b/cli/lightning-cli.c
@@ -260,6 +260,13 @@ static bool is_literal(const char *arg)
if (arglen == 0) {
return false;
}
+ /* A string of digits with a leading zero cannot be a literal unless it
+ * is "0". It should be passed with quotes as it might encode a hex
+ * data. */
+ if (strspn(arg, "0123456789") == arglen && arglen > 1 &&
+ arg[0] == '0') {
+ return false;
+ }
return strspn(arg, "0123456789.") == arglen
|| streq(arg, "true")
|| streq(arg, "false")
diff --git a/tests/test_misc.py b/tests/test_misc.py
index 16adac66..df89d8c9 100644
--- a/tests/test_misc.py
+++ b/tests/test_misc.py
@@ -1011,7 +1011,6 @@ def test_malformed_rpc(node_factory):
sock.close()
-@pytest.mark.skip
def test_valid_json_cli(node_factory):
"""Make sure lightning-cli passes valid json values, so that rust and python plugins
don't crash."""
Why this scored 37/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.