json 2.21.2 → 3.0.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: ea6afdf75f49e474e408c24daae4856891310979fbb10aa34ead66ad2fbf3321
-  data.tar.gz: 19eb129df23cde0ac607fa6ddf909d6ea5eaef0035b2180eea4c2c8a7a5c5ff0
+  metadata.gz: 4963523aa43ad467929b9530b04f5c27a37dbbb1891186251d1495f3fac1f5ee
+  data.tar.gz: caf3f18bf24b587b0832f911b692f1e1149c1bfc5d14b5c5e1b255f6f95689f9
 SHA512:
-  metadata.gz: c2212cdac41569ebd41e83e6d1ea3324e944f6a8db0070a2805f2213da7341a05cc8eab4dc6d77852f30d31a8951f36d435fdb0aff647776eb8f42cee25113ef
-  data.tar.gz: b16fdb8a1f5384aa6e9064c7884c0f7ec96632bc2c1c6324cc2e902459e9ac94559ec691cf45dea30fc374fab74ce4e3a82f8bb9d0ec22e0ddd5357764076942
+  metadata.gz: 78c8ac1a917008d3724b2a2e708d96c929de3924e4d7e1d85eb87e02a0e0a0c827bbe320464b8bb2ab8f6816ba0e5d48a8d57d3d5f00b15093aad8b9f12ce66b
+  data.tar.gz: '03867f4f7fef6bd2c14e5bfc1e426b710ad662807306c3475b63a6464e20ed10cb59646b1d6ff2b8b9b88ecb74150d7619133d8e0993c1b9666c7a7e6dd9315b'

data/CHANGES.md

@@ -2,9 +2,59 @@
 
 ### Unreleased
 
+### 2026-09-08 (3.0.1)
+
+* Restore the `limit` positional argument of `JSON.dump`.
+
+### 2026-09-07 (3.0.0)
+
+* Add `JSON::ParserError#json_path` to locate parse errors in the document as a JSONPath-style string (e.g. `$.foo[0].bar`). For duplicate key errors it points at the duplicated key itself.
+* Fix the parser to also reject lone trailing UTF-16 surrogates (`\uDCxx` with no leading partner), symmetric to the leading-surrogate case. The Java parser already rejected these; this closes the CRuby/JRuby parity gap.
+
+### 2026-08-11 (3.0.0.rc1)
+
+With the removal of the insecure `create_additions` option, `JSON.load` and `JSON.dump` are
+now safe to use. Them being unsafe by default caused multiple security vulnerabilites in the past.
+
+If you did depend on `create_additions`, the recommended migration is to [implement a custom serializer using
+`JSON::Coder`](https://byroot.github.io/ruby/json/2025/08/02/whats-wrong-with-the-json-gem-api.html#the-create_additions-option).
+
+All the mutable default options, such as `JSON.load_default_options` have been removed.
+They were preventing Ractor compatiblity, and causing bug in libraries using JSON expecting the default behavior.
+`JSON` methods now always behave the same unless monkey patched.
+
+All methods options are now either keyword arguments or checked like keyword arguments, meaning
+unknown options such as typos raise `ArgumentError`.
+
+Duplicated keys are now rejected by default.
+
+JavaScript comments in documents are no longer supported by default.
+
+Numerous rarely used aliases have been removed.
+
+* `JSON.load` defaults are now safe to use.
+* All unknown options will now cause an `ArgumentError` rather than to be ignored.
+* The `allow_comments` parsing option now defaults to `false`.
+* The `allow_duplicate_key` option now defaults to `false`, for both parsing and generating JSON.
+* Removed the `limit` positional argument of `JSON.dump`.
+* Removed the `escape_slash` alias of `script_safe`.
+* Removed `Kernel#j` and `Kernel#jj`.
+* Removed `JSON.load_default_options`.
+* Removed `JSON.unsafe_load_default_options`.
+* Removed `JSON.dump_default_options`.
+* Removed `JSON::State#[]` and `JSON::State#[]=`.
+* Removed `JSON.unparse`.
+* Removed `JSON.fast_generate`.
+* Removed `JSON.fast_unparse`.
+* Removed `JSON.pretty_unparse`.
+* Removed `JSON.restore`.
+* Removed `JSON::PRETTY_STATE_PROTOTYPE`.
+* Removed the insecure `create_additions` option.
+* Removed `JSON::GenericObject`.
+
 ### 2026-07-31 (2.21.2)
 
-* Fix a use-after-free bug in `JSON::ResumableParser`. [GHSA-9hj4-r449-hfvc].
+* Fix a use-after-free bug in `JSON::ResumableParser`. [GHSA-9hj4-r449-hfvc][CVE-2026-71847].
 
 ### 2026-07-13 (2.21.1)
 

data/README.md

@@ -14,10 +14,7 @@ UTF-16 surrogate pairs in order to be able to generate the whole range of
 unicode code points.
 
 All strings, that are to be encoded as JSON strings, should be UTF-8 byte
-sequences on the Ruby side. To encode raw binary strings, that aren't UTF-8
-encoded, please use the to\_json\_raw\_object method of String (which produces
-an object, that contains a byte array) and decode the result on the receiving
-endpoint.
+sequences on the Ruby side.
 
 ## Installation
 
@@ -49,8 +46,7 @@ JSON.generate(data)
 ```
 
 You can also use the `pretty_generate` method (which formats the output more
-verbosely and nicely) or `fast_generate` (which doesn't do any of the security
-checks generate performs, e. g. nesting deepness checks).
+verbosely and nicely).
 
 ## Casting non native types
 
@@ -143,84 +139,12 @@ posts_json.map! { |post_json| JSON::Fragment.new(post_json) }
 JSON.generate({ posts: posts_json, count: posts_json.count })
 ```
 
-## Round-tripping arbitrary types
-
-> [!CAUTION]
-> You should never use `JSON.unsafe_load` nor `JSON.parse(str, create_additions: true)` to parse untrusted user input,
-> as it can lead to remote code execution vulnerabilities.
-
-To create a JSON document from a ruby data structure, you can call
-`JSON.generate` like that:
-
-```ruby
-json = JSON.generate [1, 2, {"a"=>3.141}, false, true, nil, 4..10]
-# => "[1,2,{\"a\":3.141},false,true,null,\"4..10\"]"
-```
-
-To get back a ruby data structure from a JSON document, you have to call
-JSON.parse on it:
-
-```ruby
-JSON.parse json
-# => [1, 2, {"a"=>3.141}, false, true, nil, "4..10"]
-```
-
-Note, that the range from the original data structure is a simple
-string now. The reason for this is, that JSON doesn't support ranges
-or arbitrary classes. In this case the json library falls back to call
-`Object#to_json`, which is the same as `#to_s.to_json`.
-
-It's possible to add JSON support serialization to arbitrary classes by
-simply implementing a more specialized version of the `#to_json method`, that
-should return a JSON object (a hash converted to JSON with `#to_json`) like
-this (don't forget the `*a` for all the arguments):
-
-```ruby
-class Range
-  def to_json(*a)
-    {
-      'json_class'   => self.class.name, # = 'Range'
-      'data'         => [ first, last, exclude_end? ]
-    }.to_json(*a)
-  end
-end
-```
-
-The hash key `json_class` is the class, that will be asked to deserialise the
-JSON representation later. In this case it's `Range`, but any namespace of
-the form `A::B` or `::A::B` will do. All other keys are arbitrary and can be
-used to store the necessary data to configure the object to be deserialised.
-
-If the key `json_class` is found in a JSON object, the JSON parser checks
-if the given class responds to the `json_create` class method. If so, it is
-called with the JSON object converted to a Ruby hash. So a range can
-be deserialised by implementing `Range.json_create` like this:
-
-```ruby
-class Range
-  def self.json_create(o)
-    new(*o['data'])
-  end
-end
-```
-
-Now it possible to serialise/deserialise ranges as well:
-
-```ruby
-json = JSON.generate [1, 2, {"a"=>3.141}, false, true, nil, 4..10]
-# => "[1,2,{\"a\":3.141},false,true,null,{\"json_class\":\"Range\",\"data\":[4,10,false]}]"
-JSON.parse json
-# => [1, 2, {"a"=>3.141}, false, true, nil, 4..10]
-json = JSON.generate [1, 2, {"a"=>3.141}, false, true, nil, 4..10]
-# => "[1,2,{\"a\":3.141},false,true,null,{\"json_class\":\"Range\",\"data\":[4,10,false]}]"
-JSON.unsafe_load json
-# => [1, 2, {"a"=>3.141}, false, true, nil, 4..10]
-```
+## Pretty Printing
 
 `JSON.generate` always creates the shortest possible string representation of a
 ruby data structure in one line. This is good for data storage or network
 protocols, but not so good for humans to read. Fortunately there's also
-`JSON.pretty_generate` (or `JSON.pretty_generate`) that creates a more readable
+`JSON.pretty_generate` that creates a more readable
 output:
 
 ```ruby
@@ -245,10 +169,6 @@ output:
  ]
 ```
 
-There are also the methods `Kernel#j` for generate, and `Kernel#jj` for
-`pretty_generate` output to the console, that work analogous to Core Ruby's `p` and
-the `pp` library's `pp` methods.
-
 ## Security
 
 When parsing or serializing untrusted input, parser and generator options should never be user controlled.

data/ext/json/ext/generator/generator.c

@@ -9,12 +9,6 @@
 
 /* ruby api and some helpers */
 
-enum duplicate_key_action {
-    JSON_DEPRECATED = 0,
-    JSON_IGNORE,
-    JSON_RAISE,
-};
-
 typedef struct JSON_Generator_StateStruct {
     VALUE indent;
     VALUE space;
@@ -27,8 +21,7 @@ typedef struct JSON_Generator_StateStruct {
     long depth;
     long buffer_initial_length;
 
-    enum duplicate_key_action on_duplicate_key;
-
+    bool allow_duplicate_key;
     bool as_json_single_arg;
     bool allow_nan;
     bool ascii_only;
@@ -41,7 +34,7 @@ static VALUE mJSON, cState, cFragment, eGeneratorError, eNestingError, Encoding_
 
 static ID i_to_s, i_to_json, i_new, i_encode;
 static VALUE sym_indent, sym_space, sym_space_before, sym_object_nl, sym_array_nl, sym_max_nesting, sym_allow_nan, sym_allow_duplicate_key,
-             sym_ascii_only, sym_depth, sym_buffer_initial_length, sym_script_safe, sym_escape_slash, sym_strict, sym_as_json, sym_sort_keys;
+             sym_ascii_only, sym_depth, sym_buffer_initial_length, sym_script_safe, sym_strict, sym_as_json, sym_sort_keys;
 
 
 #define GET_STATE_TO(self, state) \
@@ -956,9 +949,8 @@ json_inspect_hash_with_mixed_keys(struct hash_foreach_arg *arg)
     arg->mixed_keys_encountered = true;
 
     JSON_Generator_State *state = arg->data->state;
-    if (state->on_duplicate_key != JSON_IGNORE) {
-        VALUE do_raise = state->on_duplicate_key == JSON_RAISE ? Qtrue : Qfalse;
-        rb_funcall(mJSON, rb_intern("on_mixed_keys_hash"), 2, arg->hash, do_raise);
+    if (!state->allow_duplicate_key) {
+        rb_funcall(mJSON, rb_intern("on_mixed_keys_hash"), 1, arg->hash);
     }
 }
 
@@ -1132,15 +1124,6 @@ static void generate_json_fallback(FBuffer *buffer, struct generate_json_data *d
     }
 }
 
-static inline void generate_json_symbol(FBuffer *buffer, struct generate_json_data *data, VALUE obj)
-{
-    if (data->state->strict) {
-        generate_json_string(buffer, data, rb_sym2str(obj));
-    } else {
-        generate_json_fallback(buffer, data, obj);
-    }
-}
-
 static void generate_json_null(FBuffer *buffer, struct generate_json_data *data, VALUE obj)
 {
     fbuffer_append(buffer, "null", 4);
@@ -1226,7 +1209,13 @@ start:
         } else if (RB_FLONUM_P(obj)) {
             generate_json_float(buffer, data, obj);
         } else if (RB_STATIC_SYM_P(obj)) {
-            generate_json_symbol(buffer, data, obj);
+            if (data->state->strict) {
+                obj = rb_sym2str(obj);
+                JSON_ASSERT(RBASIC_CLASS(obj) == rb_cString);
+                goto generate_string;
+            }
+
+            generate_json_fallback(buffer, data, obj);
         } else {
             goto general;
         }
@@ -1247,6 +1236,7 @@ start:
             case T_STRING:
                 if (fallback && klass != rb_cString) goto general;
 
+            generate_string:
                 if (RB_LIKELY(valid_json_string_p(obj))) {
                     raw_generate_json_string(buffer, data, obj);
                 } else if (as_json_called) {
@@ -1258,7 +1248,13 @@ start:
                 }
                 break;
             case T_SYMBOL:
-                generate_json_symbol(buffer, data, obj);
+                if (data->state->strict) {
+                    obj = rb_sym2str(obj);
+                    JSON_ASSERT(RBASIC_CLASS(obj) == rb_cString);
+                    goto generate_string;
+                }
+
+                generate_json_fallback(buffer, data, obj);
                 break;
             case T_FLOAT:
                 if (fallback && klass != rb_cFloat) goto general;
@@ -1784,14 +1780,7 @@ static VALUE cState_sort_keys_set(VALUE self, VALUE value)
 static VALUE cState_allow_duplicate_key_p(VALUE self)
 {
     GET_STATE(self);
-    switch (state->on_duplicate_key) {
-        case JSON_IGNORE:
-            return Qtrue;
-        case JSON_DEPRECATED:
-            return Qnil;
-        default:
-            return Qfalse;
-    }
+    return state->allow_duplicate_key ? Qtrue : Qfalse;
 }
 
 /*
@@ -1856,6 +1845,7 @@ static VALUE cState_buffer_initial_length_set(VALUE self, VALUE buffer_initial_l
 struct configure_state_data {
     JSON_Generator_State *state;
     VALUE vstate;  // Ruby object that owns the state, or Qfalse if stack-allocated
+    VALUE unknown_keywords;
 };
 
 static inline void state_write_value(struct configure_state_data *data, VALUE *field, VALUE value)
@@ -1883,9 +1873,8 @@ static int configure_state_i(VALUE key, VALUE val, VALUE _arg)
     else if (key == sym_depth)                 { state->depth = depth_config(val); }
     else if (key == sym_buffer_initial_length) { buffer_initial_length_set(state, val); }
     else if (key == sym_script_safe)           { state->script_safe = RTEST(val); }
-    else if (key == sym_escape_slash)          { state->script_safe = RTEST(val); }
     else if (key == sym_strict)                { state->strict = RTEST(val); }
-    else if (key == sym_allow_duplicate_key)   { state->on_duplicate_key = RTEST(val) ? JSON_IGNORE : JSON_RAISE; }
+    else if (key == sym_allow_duplicate_key)   { state->allow_duplicate_key = RTEST(val); }
     else if (key == sym_as_json)               {
         VALUE proc = RTEST(val) ? rb_convert_type(val, T_DATA, "Proc", "to_proc") : Qfalse;
         state->as_json_single_arg = proc && rb_proc_arity(proc) == 1;
@@ -1894,6 +1883,12 @@ static int configure_state_i(VALUE key, VALUE val, VALUE _arg)
     else if (key == sym_sort_keys)             {
         state_write_value(data, &state->sort_keys, normalize_sort_keys(val));
     }
+    else {
+        if (!data->unknown_keywords) {
+            data->unknown_keywords = rb_obj_hide(rb_ary_new());
+        }
+        rb_ary_push(data->unknown_keywords, key);
+    }
     return ST_CONTINUE;
 }
 
@@ -1907,12 +1902,15 @@ static void configure_state(JSON_Generator_State *state, VALUE vstate, VALUE con
 
     struct configure_state_data data = {
         .state = state,
-        .vstate = vstate
+        .vstate = vstate,
+        .unknown_keywords = Qfalse,
     };
 
     // We assume in most cases few keys are set so it's faster to go over
     // the provided keys than to check all possible keys.
     rb_hash_foreach(config, configure_state_i, (VALUE)&data);
+
+    raise_argument_error_on_unknown_keywords(data.unknown_keywords);
 }
 
 static VALUE cState_configure(VALUE self, VALUE opts)
@@ -2006,9 +2004,6 @@ void Init_generator(void)
     rb_define_method(cState, "script_safe", cState_script_safe, 0);
     rb_define_method(cState, "script_safe?", cState_script_safe, 0);
     rb_define_method(cState, "script_safe=", cState_script_safe_set, 1);
-    rb_define_alias(cState, "escape_slash", "script_safe");
-    rb_define_alias(cState, "escape_slash?", "script_safe?");
-    rb_define_alias(cState, "escape_slash=", "script_safe=");
     rb_define_method(cState, "strict", cState_strict, 0);
     rb_define_method(cState, "strict?", cState_strict, 0);
     rb_define_method(cState, "strict=", cState_strict_set, 1);
@@ -2050,7 +2045,6 @@ void Init_generator(void)
     sym_depth = ID2SYM(rb_intern("depth"));
     sym_buffer_initial_length = ID2SYM(rb_intern("buffer_initial_length"));
     sym_script_safe = ID2SYM(rb_intern("script_safe"));
-    sym_escape_slash = ID2SYM(rb_intern("escape_slash"));
     sym_strict = ID2SYM(rb_intern("strict"));
     sym_as_json = ID2SYM(rb_intern("as_json"));
     sym_allow_duplicate_key = ID2SYM(rb_intern("allow_duplicate_key"));

data/ext/json/ext/json.h

@@ -180,4 +180,17 @@ static inline VALUE json_rb_catch_obj(VALUE tag, VALUE (*func)(VALUE args), VALU
 
 #endif // JSON_TRUFFLERUBY_RB_CATCH_BUG
 
+static inline void raise_argument_error_on_unknown_keywords(VALUE unknown_keywords)
+{
+    if (RB_UNLIKELY(unknown_keywords)) {
+        if (RARRAY_LEN(unknown_keywords) == 1) {
+            rb_raise(rb_eArgError, "unknown keyword: %" PRIsVALUE, RARRAY_AREF(unknown_keywords, 0));
+        }
+        else {
+            VALUE keywords = rb_ary_join(unknown_keywords, rb_utf8_str_new_cstr(", "));
+            rb_raise(rb_eArgError, "unknown keywords: %" PRIsVALUE, keywords);
+        }
+    }
+}
+
 #endif // _JSON_H_