Merge pull request #6 from 4026/master

Preventing large ints being converted to floats when decoding.

1 files changed, 14 insertions, 1 deletions

diff --git a/Authentication/JWT.php b/Authentication/JWT.php
index aabc65b..cd72a74 100644
--- a/Authentication/JWT.php
+++ b/Authentication/JWT.php
@@ -130,7 +130,20 @@ class JWT
      */
     public static function jsonDecode($input)
     {
-        $obj = json_decode($input);
+        if (version_compare(PHP_VERSION, '5.4.0', '>=')) {
+            /* In PHP >=5.4.0, json_decode() accepts an options parameter, that allows you to specify that large ints (like Steam
+             * Transaction IDs) should be treated as strings, rather than the PHP default behaviour of converting them to floats.
+             */
+            $obj = json_decode($input, false, 512, JSON_BIGINT_AS_STRING);
+        } else {
+            /* Not all servers will support that, however, so for older versions we must manually detect large ints in the JSON
+             * string and quote them (thus converting them to strings) before decoding, hence the preg_replace() call.
+             */
+            $max_int_length = strlen((string) PHP_INT_MAX) - 1;
+            $json_without_bigints = preg_replace('/:\s*(\d{'.$max_int_length.',})/', ': "$1"', $input);
+            $obj = json_decode($json_without_bigints);
+        }
+
         if (function_exists('json_last_error') && $errno = json_last_error()) {
             JWT::_handleJsonError($errno);
         } else if ($obj === null && $input !== 'null') {