json 2.18.1 → 3.0.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: cb2890db4c527125d27bc7c21fc64d3ac532ffbec8080f89a678daf48c36e09e
-  data.tar.gz: c4b37d085d05d3c43df97b3c24898dc6be61c76ba64c749b5a8a86bf4fc1198d
+  metadata.gz: b4a457db7bd0eba155736808c796e81741e7ea72438768e183a7b7a795e8de4e
+  data.tar.gz: 61bb013e78224c5c91f620d3097986735411befd5139f33eaecb2c3c510ababe
 SHA512:
-  metadata.gz: fb55ef5a0aa6961ef0fe3bb30f398834820357045ad27a8fdb7e53eaba3af7c4d356ef26c0e73b7a87d2d9d51e500eae7193d7d1ae3aa1058c7973bcc462674b
-  data.tar.gz: bfb499789bbcee7f5f8d67e32ded664dc62c632ae39fe80bf4bff3d6aec16eee3730a7c4883216a393326f2ab33e94e5f9c58da4c5b31627347108c36c2b211c
+  metadata.gz: 6e0b4b4a8160235dcef28c7924ecda754a7ae792a714e6b5fbc5baa810fd358129c4340dd1056d31df823bf139f2b42bccb9c2d400c7282079d3dcf3b2f8c2c8
+  data.tar.gz: e67782447e1934dcada56b848982e6bb15708997b9eca220f7b631470734e0b14b2b227ac82612b03b8eb6b3d54b7686d4627a6d551d05b8252da40203f07087

data/CHANGES.md

@@ -2,6 +2,125 @@
 
 ### Unreleased
 
+### 2026-09-07 (3.0.0)
+
+* Add `JSON::ParserError#json_path` to locate parse errors in the document as a JSONPath-style string (e.g. `$.foo[0].bar`). For duplicate key errors it points at the duplicated key itself.
+* Fix the parser to also reject lone trailing UTF-16 surrogates (`\uDCxx` with no leading partner), symmetric to the leading-surrogate case. The Java parser already rejected these; this closes the CRuby/JRuby parity gap.
+
+### 2026-08-11 (3.0.0.rc1)
+
+With the removal of the insecure `create_additions` option, `JSON.load` and `JSON.dump` are
+now safe to use. Them being unsafe by default caused multiple security vulnerabilites in the past.
+
+If you did depend on `create_additions`, the recommended migration is to [implement a custom serializer using
+`JSON::Coder`](https://byroot.github.io/ruby/json/2025/08/02/whats-wrong-with-the-json-gem-api.html#the-create_additions-option).
+
+All the mutable default options, such as `JSON.load_default_options` have been removed.
+They were preventing Ractor compatiblity, and causing bug in libraries using JSON expecting the default behavior.
+`JSON` methods now always behave the same unless monkey patched.
+
+All methods options are now either keyword arguments or checked like keyword arguments, meaning
+unknown options such as typos raise `ArgumentError`.
+
+Duplicated keys are now rejected by default.
+
+JavaScript comments in documents are no longer supported by default.
+
+Numerous rarely used aliases have been removed.
+
+* `JSON.load` defaults are now safe to use.
+* All unknown options will now cause an `ArgumentError` rather than to be ignored.
+* The `allow_comments` parsing option now defaults to `false`.
+* The `allow_duplicate_key` option now defaults to `false`, for both parsing and generating JSON.
+* Removed the `limit` positional argument of `JSON.dump`.
+* Removed the `escape_slash` alias of `script_safe`.
+* Removed `Kernel#j` and `Kernel#jj`.
+* Removed `JSON.load_default_options`.
+* Removed `JSON.unsafe_load_default_options`.
+* Removed `JSON.dump_default_options`.
+* Removed `JSON::State#[]` and `JSON::State#[]=`.
+* Removed `JSON.unparse`.
+* Removed `JSON.fast_generate`.
+* Removed `JSON.fast_unparse`.
+* Removed `JSON.pretty_unparse`.
+* Removed `JSON.restore`.
+* Removed `JSON::PRETTY_STATE_PROTOTYPE`.
+* Removed the insecure `create_additions` option.
+* Removed `JSON::GenericObject`.
+
+### 2026-07-31 (2.21.2)
+
+* Fix a use-after-free bug in `JSON::ResumableParser`. [GHSA-9hj4-r449-hfvc][CVE-2026-71847].
+
+### 2026-07-13 (2.21.1)
+
+* Fix a compilation issue on Window and Microsoft Visual C++.
+
+### 2026-07-12 (2.21.0)
+
+* `JSON.generate` now accept a `sort_keys` option, which takes either a boolean or a block.
+* Added `#empty?` and `#partial_value?` methods on `JSON::ResumableParser`.
+* Numerous correctness and performance fixes for `JSON::ResumableParser`.
+* Avoid triggering Ruby's `float out of range` warning when parsing out of range numbers.
+* Declare C types with Ruby 4.1 `RUBY_TYPED_THREAD_SAFE_FREE`.
+
+### 2026-06-23 (2.20.0)
+
+* Both C and Java parsers are no longer recursive, so parsing very deep documents with `max_nesting: false` will no longer
+  result in `SystemStackError stack level too deep` errors.
+  * The `:max_nesting` option still defaults to `100`.
+* Optimized floating point number parsing further by replacing the ryu algorithm by a port of Eisel-Lemire Fast Float.
+* Added `JSON::ResumableParser` to parse streams of JSON documents. Not yet available on JRuby.
+* Deprecate default support of JavaScript comments in the parser and add `allow_comments: true` parsing option.
+* Integrate with Ruby 4.1 `ruby_sized_xfree`.
+
+### 2026-06-11 (2.19.9)
+
+* Fix buffer overflow that could lead to a crash when writing JSON directly into an IO
+  with `JSON.generate(object, io)`. [CVE-2026-54696].
+
+### 2026-06-03 (2.19.8)
+
+* Fix 1-byte buffer overread on EOS errors.
+* Handle invalid types passed as `max_nesting` option.
+
+### 2026-05-28 (2.19.7)
+
+* Fix some more edge cases with out of range floats.
+* Ensure the string provided to `JSON.parse` can't be mutated during parsing.
+* Add missing write barriers in `State#dup`.
+* Further validate generator `depth` config.
+
+### 2026-05-28 (2.19.6)
+
+* Cleanly handle overly large `depth` generator argument.
+* Add missing write barrier in `ParserConfig`.
+
+### 2026-05-04 (2.19.5)
+
+* Cap the parser to emit a maximum of 5 deprecation warnings per document. Emitting more is not helpful.
+
+### 2026-04-19 (2.19.4)
+
+* Fix parsing of out of range floats (very large exponents that lead to either `0.0` or `Inf`).
+
+### 2026-03-25 (2.19.3)
+
+* Fix handling of unescaped control characters preceeded by a backslash.
+
+### 2026-03-18 (2.19.2)
+
+* Fix a format string injection vulnerability in `JSON.parse(doc, allow_duplicate_key: false)`. `CVE-2026-33210`.
+
+### 2026-03-08 (2.19.1)
+
+* Fix a compiler dependent GC bug introduced in `2.18.0`.
+
+### 2026-03-06 (2.19.0)
+
+* Fix `allow_blank` parsing option to no longer allow invalid types (e.g. `load([], allow_blank: true)` now raise a type error).
+* Add `allow_invalid_escape` parsing option to ignore backslashes that aren't followed by one of the valid escape characters.
+
 ### 2026-02-03 (2.18.1)
 
 * Fix a potential crash in very specific circumstance if GC triggers during a call to `to_json`
@@ -11,6 +130,10 @@
 
 * Add `:allow_control_characters` parser options, to allow JSON strings containing unescaped ASCII control characters (e.g. newlines).
 
+### 2026-03-18 (2.17.1.2) - Security Backport
+
+* Fix a format string injection vulnerability in `JSON.parse(doc, allow_duplicate_key: false)`. `CVE-2026-33210`.
+
 ### 2025-12-04 (2.17.1)
 
 * Fix a regression in parsing of unicode surogate pairs (`\uXX\uXX`) that could cause an invalid string to be returned.
@@ -37,6 +160,10 @@
 * Optimized numbers parsing using SWAR (thanks to Scott Myron).
 * Optimized parsing of pretty printed documents using SWAR (thanks to Scott Myron).
 
+### 2026-03-18 (2.15.2.1) - Security Backport
+
+* Fix a format string injection vulnerability in `JSON.parse(doc, allow_duplicate_key: false)`. `CVE-2026-33210`.
+
 ### 2025-10-25 (2.15.2)
 
 * Fix `JSON::Coder` to have one dedicated depth counter per invocation.

data/LEGAL

@@ -15,6 +15,6 @@ ext/json/ext/vendor/jeaiii-ltoa.h::
   This file is adapted from https://github.com/jeaiii/itoa
   It is licensed under the MIT License
 
-ext/json/ext/vendor/ryu.h::
-  This file is adapted from the Ryu algorithm by Ulf Adams https://github.com/ulfjack/ryu.
-  It is dual-licensed under Apache License 2.0 OR Boost Software License 1.0.
+ext/json/ext/vendor/fast_float_parser.h::
+  This file is adapted from the Fast Float C++ library by The fast_float authors https://github.com/fastfloat/fast_float
+  It is licensed under the MIT License

data/README.md

@@ -14,10 +14,7 @@ UTF-16 surrogate pairs in order to be able to generate the whole range of
 unicode code points.
 
 All strings, that are to be encoded as JSON strings, should be UTF-8 byte
-sequences on the Ruby side. To encode raw binary strings, that aren't UTF-8
-encoded, please use the to\_json\_raw\_object method of String (which produces
-an object, that contains a byte array) and decode the result on the receiving
-endpoint.
+sequences on the Ruby side.
 
 ## Installation
 
@@ -49,8 +46,7 @@ JSON.generate(data)
 ```
 
 You can also use the `pretty_generate` method (which formats the output more
-verbosely and nicely) or `fast_generate` (which doesn't do any of the security
-checks generate performs, e. g. nesting deepness checks).
+verbosely and nicely).
 
 ## Casting non native types
 
@@ -85,7 +81,7 @@ Both of these behavior can be disabled using the `strict: true` option:
 
 ```ruby
 JSON.generate(Object.new, strict: true) # => Object not allowed in JSON (JSON::GeneratorError)
-JSON.generate(Position.new(1, 2)) # => Position not allowed in JSON (JSON::GeneratorError)
+JSON.generate(Position.new(1, 2), strict: true) # => Position not allowed in JSON (JSON::GeneratorError)
 ```
 
 ## JSON::Coder
@@ -117,13 +113,13 @@ It is also called for objects that do have a JSON equivalent, but are used as Ha
 as well as for strings that aren't valid UTF-8:
 
 ```ruby
-coder = JSON::Combining.new do |object, is_object_key|
+coder = JSON::Coder.new do |object, is_object_key|
   case object
   when String
-    if !string.valid_encoding? || string.encoding != Encoding::UTF_8
-      Base64.encode64(string)
+    if !object.valid_encoding? || object.encoding != Encoding::UTF_8
+      Base64.encode64(object)
     else
-      string
+      object
     end
   else
     object
@@ -143,84 +139,12 @@ posts_json.map! { |post_json| JSON::Fragment.new(post_json) }
 JSON.generate({ posts: posts_json, count: posts_json.count })
 ```
 
-## Round-tripping arbitrary types
-
-> [!CAUTION]
-> You should never use `JSON.unsafe_load` nor `JSON.parse(str, create_additions: true)` to parse untrusted user input,
-> as it can lead to remote code execution vulnerabilities.
-
-To create a JSON document from a ruby data structure, you can call
-`JSON.generate` like that:
-
-```ruby
-json = JSON.generate [1, 2, {"a"=>3.141}, false, true, nil, 4..10]
-# => "[1,2,{\"a\":3.141},false,true,null,\"4..10\"]"
-```
-
-To get back a ruby data structure from a JSON document, you have to call
-JSON.parse on it:
-
-```ruby
-JSON.parse json
-# => [1, 2, {"a"=>3.141}, false, true, nil, "4..10"]
-```
-
-Note, that the range from the original data structure is a simple
-string now. The reason for this is, that JSON doesn't support ranges
-or arbitrary classes. In this case the json library falls back to call
-`Object#to_json`, which is the same as `#to_s.to_json`.
-
-It's possible to add JSON support serialization to arbitrary classes by
-simply implementing a more specialized version of the `#to_json method`, that
-should return a JSON object (a hash converted to JSON with `#to_json`) like
-this (don't forget the `*a` for all the arguments):
-
-```ruby
-class Range
-  def to_json(*a)
-    {
-      'json_class'   => self.class.name, # = 'Range'
-      'data'         => [ first, last, exclude_end? ]
-    }.to_json(*a)
-  end
-end
-```
-
-The hash key `json_class` is the class, that will be asked to deserialise the
-JSON representation later. In this case it's `Range`, but any namespace of
-the form `A::B` or `::A::B` will do. All other keys are arbitrary and can be
-used to store the necessary data to configure the object to be deserialised.
-
-If the key `json_class` is found in a JSON object, the JSON parser checks
-if the given class responds to the `json_create` class method. If so, it is
-called with the JSON object converted to a Ruby hash. So a range can
-be deserialised by implementing `Range.json_create` like this:
-
-```ruby
-class Range
-  def self.json_create(o)
-    new(*o['data'])
-  end
-end
-```
-
-Now it possible to serialise/deserialise ranges as well:
-
-```ruby
-json = JSON.generate [1, 2, {"a"=>3.141}, false, true, nil, 4..10]
-# => "[1,2,{\"a\":3.141},false,true,null,{\"json_class\":\"Range\",\"data\":[4,10,false]}]"
-JSON.parse json
-# => [1, 2, {"a"=>3.141}, false, true, nil, 4..10]
-json = JSON.generate [1, 2, {"a"=>3.141}, false, true, nil, 4..10]
-# => "[1,2,{\"a\":3.141},false,true,null,{\"json_class\":\"Range\",\"data\":[4,10,false]}]"
-JSON.unsafe_load json
-# => [1, 2, {"a"=>3.141}, false, true, nil, 4..10]
-```
+## Pretty Printing
 
 `JSON.generate` always creates the shortest possible string representation of a
 ruby data structure in one line. This is good for data storage or network
 protocols, but not so good for humans to read. Fortunately there's also
-`JSON.pretty_generate` (or `JSON.pretty_generate`) that creates a more readable
+`JSON.pretty_generate` that creates a more readable
 output:
 
 ```ruby
@@ -245,9 +169,16 @@ output:
  ]
 ```
 
-There are also the methods `Kernel#j` for generate, and `Kernel#jj` for
-`pretty_generate` output to the console, that work analogous to Core Ruby's `p` and
-the `pp` library's `pp` methods.
+## Security
+
+When parsing or serializing untrusted input, parser and generator options should never be user controlled.
+
+```ruby
+# Dangerous, DO NOT DO THIS.
+JSON.generate(params[:data], params[:options])
+```
+
+Security vulnerability reports relying on attacker controlled parsing or generator options will be handled as regular bug fixes.
 
 ## Development
 
@@ -295,5 +226,3 @@ The latest version of this library can be downloaded at
 Online Documentation should be located at
 
 * https://www.rubydoc.info/gems/json
-
-[Ragel]: http://www.colm.net/open-source/ragel/

data/ext/json/ext/fbuffer/fbuffer.h

@@ -11,11 +11,11 @@ enum fbuffer_type {
 
 typedef struct FBufferStruct {
     enum fbuffer_type type;
-    unsigned long initial_length;
-    unsigned long len;
-    unsigned long capa;
+    size_t initial_length;
+    size_t len;
+    size_t capa;
 #if JSON_DEBUG
-    unsigned long requested;
+    size_t requested;
 #endif
     char *ptr;
     VALUE io;
@@ -32,25 +32,29 @@ typedef struct FBufferStruct {
 
 static void fbuffer_free(FBuffer *fb);
 static void fbuffer_clear(FBuffer *fb);
-static void fbuffer_append(FBuffer *fb, const char *newstr, unsigned long len);
+static void fbuffer_append(FBuffer *fb, const char *newstr, size_t len);
 static void fbuffer_append_long(FBuffer *fb, long number);
 static inline void fbuffer_append_char(FBuffer *fb, char newchr);
 static VALUE fbuffer_finalize(FBuffer *fb);
 
-static void fbuffer_stack_init(FBuffer *fb, unsigned long initial_length, char *stack_buffer, long stack_buffer_size)
+static void fbuffer_init(FBuffer *fb, size_t initial_length, VALUE io, char *stack_buffer, size_t stack_buffer_size)
 {
-    fb->initial_length = (initial_length > 0) ? initial_length : FBUFFER_INITIAL_LENGTH_DEFAULT;
-    if (stack_buffer) {
+    if (RTEST(io)) {
+        JSON_ASSERT(fb->type == FBUFFER_HEAP_ALLOCATED);
+        fb->io = io;
+        fb->initial_length = (initial_length > 0) ? initial_length : FBUFFER_IO_BUFFER_SIZE;
+    } else {
         fb->type = FBUFFER_STACK_ALLOCATED;
         fb->ptr = stack_buffer;
         fb->capa = stack_buffer_size;
+        fb->initial_length = (initial_length > 0) ? initial_length : FBUFFER_INITIAL_LENGTH_DEFAULT;
     }
 #if JSON_DEBUG
     fb->requested = 0;
 #endif
 }
 
-static inline void fbuffer_consumed(FBuffer *fb, unsigned long consumed)
+static inline void fbuffer_consumed(FBuffer *fb, size_t consumed)
 {
 #if JSON_DEBUG
     if (consumed > fb->requested) {
@@ -64,7 +68,7 @@ static inline void fbuffer_consumed(FBuffer *fb, unsigned long consumed)
 static void fbuffer_free(FBuffer *fb)
 {
     if (fb->ptr && fb->type == FBUFFER_HEAP_ALLOCATED) {
-        ruby_xfree(fb->ptr);
+        JSON_SIZED_FREE_N(fb->ptr, fb->capa);
     }
 }
 
@@ -79,48 +83,43 @@ static void fbuffer_flush(FBuffer *fb)
     fbuffer_clear(fb);
 }
 
-static void fbuffer_realloc(FBuffer *fb, unsigned long required)
+static void fbuffer_realloc(FBuffer *fb, size_t new_capa)
 {
-    if (required > fb->capa) {
+    if (new_capa > fb->capa) {
         if (fb->type == FBUFFER_STACK_ALLOCATED) {
             const char *old_buffer = fb->ptr;
-            fb->ptr = ALLOC_N(char, required);
+            fb->ptr = ALLOC_N(char, new_capa);
             fb->type = FBUFFER_HEAP_ALLOCATED;
             MEMCPY(fb->ptr, old_buffer, char, fb->len);
         } else {
-            REALLOC_N(fb->ptr, char, required);
+            JSON_SIZED_REALLOC_N(fb->ptr, char, new_capa, fb->capa);
         }
-        fb->capa = required;
+        fb->capa = new_capa;
     }
 }
 
-static void fbuffer_do_inc_capa(FBuffer *fb, unsigned long requested)
+static void fbuffer_do_inc_capa(FBuffer *fb, size_t requested)
 {
     if (RB_UNLIKELY(fb->io)) {
-        if (fb->capa < FBUFFER_IO_BUFFER_SIZE) {
-            fbuffer_realloc(fb, FBUFFER_IO_BUFFER_SIZE);
-        } else {
+        if (fb->capa != 0) {
             fbuffer_flush(fb);
-        }
-
-        if (RB_LIKELY(requested < fb->capa)) {
-            return;
+            if (RB_LIKELY(requested < fb->capa)) {
+                return;
+            }
         }
     }
 
-    unsigned long required;
+    size_t new_capa = fb->capa ? fb->capa : fb->initial_length;
+    size_t needed_capa = requested + fb->len;
 
-    if (RB_UNLIKELY(!fb->ptr)) {
-        fb->ptr = ALLOC_N(char, fb->initial_length);
-        fb->capa = fb->initial_length;
+    while (new_capa < needed_capa) {
+        new_capa *= 2;
     }
 
-    for (required = fb->capa; requested > required - fb->len; required <<= 1);
-
-    fbuffer_realloc(fb, required);
+    fbuffer_realloc(fb, new_capa);
 }
 
-static inline void fbuffer_inc_capa(FBuffer *fb, unsigned long requested)
+static inline void fbuffer_inc_capa(FBuffer *fb, size_t requested)
 {
 #if JSON_DEBUG
     fb->requested = requested;
@@ -131,13 +130,22 @@ static inline void fbuffer_inc_capa(FBuffer *fb, unsigned long requested)
     }
 }
 
-static inline void fbuffer_append_reserved(FBuffer *fb, const char *newstr, unsigned long len)
+static inline size_t fbuffer_size_mul_or_raise(size_t a, size_t b)
+{
+    size_t result = a * b;
+    if (RB_UNLIKELY(a != 0 && (result / a) != b)) {
+        rb_raise(rb_eArgError, "Buffer overflow, the resulting document is too large to be generated");
+    }
+    return result;
+}
+
+static inline void fbuffer_append_reserved(FBuffer *fb, const char *newstr, size_t len)
 {
     MEMCPY(fb->ptr + fb->len, newstr, char, len);
     fbuffer_consumed(fb, len);
 }
 
-static inline void fbuffer_append(FBuffer *fb, const char *newstr, unsigned long len)
+static inline void fbuffer_append(FBuffer *fb, const char *newstr, size_t len)
 {
     if (len > 0) {
         fbuffer_inc_capa(fb, len);
@@ -162,19 +170,20 @@ static inline void fbuffer_append_reserved_char(FBuffer *fb, char chr)
 static void fbuffer_append_str(FBuffer *fb, VALUE str)
 {
     const char *ptr;
-    unsigned long len;
+    size_t len;
     RSTRING_GETMEM(str, ptr, len);
 
     fbuffer_append(fb, ptr, len);
+    RB_GC_GUARD(str);
 }
 
 static void fbuffer_append_str_repeat(FBuffer *fb, VALUE str, size_t repeat)
 {
     const char *ptr;
-    unsigned long len;
+    size_t len;
     RSTRING_GETMEM(str, ptr, len);
 
-    fbuffer_inc_capa(fb, repeat * len);
+    fbuffer_inc_capa(fb, fbuffer_size_mul_or_raise(repeat, len));
     while (repeat) {
 #if JSON_DEBUG
         fb->requested = len;
@@ -182,6 +191,7 @@ static void fbuffer_append_str_repeat(FBuffer *fb, VALUE str, size_t repeat)
         fbuffer_append_reserved(fb, ptr, len);
         repeat--;
     }
+    RB_GC_GUARD(str);
 }
 
 static inline void fbuffer_append_char(FBuffer *fb, char newchr)

data/ext/json/ext/generator/extconf.rb

@@ -5,6 +5,9 @@ if RUBY_ENGINE == 'truffleruby'
   File.write('Makefile', dummy_makefile("").join)
 else
   append_cflags("-std=c99")
+  have_const("RUBY_TYPED_EMBEDDABLE", "ruby.h") # RUBY_VERSION >= 3.3
+  have_func("ruby_xfree_sized", "ruby.h") # RUBY_VERSION >= 4.1
+
   $defs << "-DJSON_GENERATOR"
   $defs << "-DJSON_DEBUG" if ENV.fetch("JSON_DEBUG", "0") != "0"