From d358425e6968858e52908794d15f37e62abc74ec Mon Sep 17 00:00:00 2001
From: Nice Zombies <nineteendo19d0@gmail.com>
Date: Fri, 18 Oct 2024 14:26:29 +0200
Subject: [PATCH] gh-125682: Reject non-ASCII digits in the Python
 implementation of JSON decoder (GH-125687)

---
 Lib/json/scanner.py                                         | 2 +-
 Lib/test/test_json/test_decode.py                           | 6 ++++++
 .../Library/2024-10-18-09-51-29.gh-issue-125682.vsj4cU.rst  | 2 ++
 3 files changed, 9 insertions(+), 1 deletion(-)
 create mode 100644 Misc/NEWS.d/next/Library/2024-10-18-09-51-29.gh-issue-125682.vsj4cU.rst

diff --git a/Lib/json/scanner.py b/Lib/json/scanner.py
index 7a61cfc2d24..090897515fe 100644
--- a/Lib/json/scanner.py
+++ b/Lib/json/scanner.py
@@ -9,7 +9,7 @@
 __all__ = ['make_scanner']
 
 NUMBER_RE = re.compile(
-    r'(-?(?:0|[1-9]\d*))(\.\d+)?([eE][-+]?\d+)?',
+    r'(-?(?:0|[1-9][0-9]*))(\.[0-9]+)?([eE][-+]?[0-9]+)?',
     (re.VERBOSE | re.MULTILINE | re.DOTALL))
 
 def py_make_scanner(context):
diff --git a/Lib/test/test_json/test_decode.py b/Lib/test/test_json/test_decode.py
index 79fb239b35d..2250af964c0 100644
--- a/Lib/test/test_json/test_decode.py
+++ b/Lib/test/test_json/test_decode.py
@@ -16,6 +16,12 @@ def test_float(self):
         self.assertIsInstance(rval, float)
         self.assertEqual(rval, 1.0)
 
+    def test_nonascii_digits_rejected(self):
+        # JSON specifies only ascii digits, see gh-125687
+        for num in ["1\uff10", "0.\uff10", "0e\uff10"]:
+            with self.assertRaises(self.JSONDecodeError):
+                self.loads(num)
+
     def test_bytes(self):
         self.assertEqual(self.loads(b"1"), 1)
 
diff --git a/Misc/NEWS.d/next/Library/2024-10-18-09-51-29.gh-issue-125682.vsj4cU.rst b/Misc/NEWS.d/next/Library/2024-10-18-09-51-29.gh-issue-125682.vsj4cU.rst
new file mode 100644
index 00000000000..3eb2905ad8d
--- /dev/null
+++ b/Misc/NEWS.d/next/Library/2024-10-18-09-51-29.gh-issue-125682.vsj4cU.rst
@@ -0,0 +1,2 @@
+Reject non-ASCII digits in the Python implementation of :func:`json.loads`
+conforming to the JSON specification.