Starlette is not handling some invalid json format on Request.json()

[luzzodev]

This comes from an investigation i was doing on a Fastapi issue fastapi/fastapi#13388, but the root cause should be in starlette.

Starlette Request.json() is allowing relaxed representation of JSON format: so NaN, Infinity, -Infinity are allowed values.

starlette/starlette/requests.py

Lines 246 to 250 in 1695942

	async def json(self) -> typing.Any:
	if not hasattr(self, "_json"): # pragma: no branch
	body = await self.body()
	self._json = json.loads(body)
	return self._json

While JSONResponse.render() is stricly enforcing JSON specification.

starlette/starlette/responses.py

Lines 183 to 190 in 1695942

	def render(self, content: typing.Any) -> bytes:
	return json.dumps(
	content,
	ensure_ascii=False,
	allow_nan=False,
	indent=None,
	separators=(",", ":"),
	).encode("utf-8")

MRE

Sending as json body:

{"name": NaN}

Will start to raise exception from return JSONResponse(body)

import uvicorn
from starlette.applications import Starlette, Request
from starlette.responses import JSONResponse
from starlette.routing import Route


async def homepage(request: Request):
    body = await request.json()
    return JSONResponse(body)

routes = [
    Route("/items", endpoint=homepage, methods=["POST"])
]

app = Starlette(debug=True, routes=routes)


if __name__ == "__main__":
    uvicorn.run(app, host="0.0.0.0", port=8000)

[Kludex]

Seems duplicated: #1518