fix overly permissive parser that allowed some encodings that should

have been failure states

src/jsx_parser.erl

@@ -129,7 +129,20 @@ when is_integer(Year), is_integer(Month), is_integer(Day), is_integer(Hour), is_
         Stack,
         Config
     );
-value([{_, Value}|Tokens], Handler, Stack, Config) ->
+value([{literal, Value}|Tokens], Handler, Stack, Config)
+when Value == true; Value == false; Value == null ->
+    value([Value] ++ Tokens, Handler, Stack, Config);
+value([{integer, Value}|Tokens], Handler, Stack, Config)
+when is_integer(Value) ->
+    value([Value] ++ Tokens, Handler, Stack, Config);
+value([{float, Value}|Tokens], Handler, Stack, Config)
+when is_float(Value) ->
+    value([Value] ++ Tokens, Handler, Stack, Config);
+value([{string, Value}|Tokens], Handler, Stack, Config)
+when is_binary(Value); is_atom(Value) ->
+    value([Value] ++ Tokens, Handler, Stack, Config);
+value([{number, Value}|Tokens], Handler, Stack, Config)
+when is_float(Value); is_integer(Value) ->
     value([Value] ++ Tokens, Handler, Stack, Config);
 value([String|Tokens], Handler, Stack, Config) when is_atom(String) ->
     value([{string, atom_to_binary(String, utf8)}] ++ Tokens, Handler, Stack, Config);
@@ -1165,4 +1178,17 @@ datetime_test_() ->
     ].
 
 
+rogue_tuple_test_() ->
+    [
+        {"kv in value position of object", ?_assertError(
+          badarg,
+          parse([start_object, <<"key">>, {<<"key">>, <<"value">>}, end_object, end_json], [])
+        )},
+        {"kv in value position of list", ?_assertError(
+          badarg,
+          parse([start_array, {<<"key">>, <<"value">>}, end_array, end_json], [])
+        )}
+    ].
+
+
 -endif.