Skip to content

Substitute invalid UTF-8 in JSON error renderer output - #3465

Open
iliaal wants to merge 1 commit into
slimphp:4.xfrom
iliaal:fix/json-error-renderer-invalid-utf8
Open

Substitute invalid UTF-8 in JSON error renderer output#3465
iliaal wants to merge 1 commit into
slimphp:4.xfrom
iliaal:fix/json-error-renderer-invalid-utf8

Conversation

@iliaal

@iliaal iliaal commented Aug 23, 2026

Copy link
Copy Markdown

json_encode() returns false when any string in the payload contains an invalid UTF-8 sequence, so a JSON error response for an exception whose message or title carries raw binary data (invalid-UTF-8 user input echoed into exception messages is the common path) was emitted as a zero-length body under Content-Type: application/json. Strict API clients then fail to parse the empty body and the actual error information is silently discarded.

This adds JSON_INVALID_UTF8_SUBSTITUTE so invalid byte sequences are replaced with the UTF-8 replacement character instead of failing the whole encode. The renderer output stays valid JSON in all cases.

Reproduction on 4.x before this change:

$renderer = new \Slim\Error\Renderers\JsonErrorRenderer();
$output = $renderer(new \RuntimeException("bad \xB1\x31 bytes"), true);
var_dump(strlen($output)); // int(0)

json_encode() returns false for strings with invalid UTF-8 sequences,
so exception messages or titles carrying raw binary data produced an
empty response body under a JSON content type. Pass
JSON_INVALID_UTF8_SUBSTITUTE so invalid sequences are replaced with
the UTF-8 replacement character instead of discarding the whole
payload.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant