oj 3.16.11 → 3.17.6

data/ext/oj/sparse.c

@@ -290,13 +290,13 @@ static void read_escaped_str(ParseInfo pi) {
         case NEXT_HASH_NEW:
         case NEXT_HASH_KEY:
             if (Qundef == (parent->key_val = pi->hash_key(pi, buf.head, buf_len(&buf)))) {
-                parent->klen = buf_len(&buf);
-                parent->key  = malloc(parent->klen + 1);
-                memcpy((char *)parent->key, buf.head, parent->klen);
-                *(char *)(parent->key + parent->klen) = '\0';
+                parent->klen   = buf_len(&buf);
+                parent->key    = oj_strndup(buf.head, parent->klen);
+                parent->kalloc = 1;
             } else {
-                parent->key  = "";
-                parent->klen = 0;
+                parent->key    = "";
+                parent->klen   = 0;
+                parent->kalloc = 0;
             }
             parent->k1   = *pi->rd.str;
             parent->next = NEXT_HASH_COLON;
@@ -399,6 +399,7 @@ static void read_num(ParseInfo pi) {
     char            c;
 
     reader_protect(&pi->rd);
+    ni.pi       = pi;
     ni.i        = 0;
     ni.num      = 0;
     ni.div      = 1;
@@ -415,7 +416,7 @@ static void read_num(ParseInfo pi) {
         ni.bigdec_load = pi->options.compat_bigdec;
     } else {
         ni.no_big      = (FloatDec == pi->options.bigdec_load || FastDec == pi->options.bigdec_load ||
-                     RubyDec == pi->options.bigdec_load);
+                          RubyDec == pi->options.bigdec_load);
         ni.bigdec_load = pi->options.bigdec_load;
     }
 
@@ -549,6 +550,7 @@ static void read_nan(ParseInfo pi) {
     struct _numInfo ni;
     char            c;
 
+    ni.pi       = pi;
     ni.str      = pi->rd.str;
     ni.i        = 0;
     ni.num      = 0;
@@ -565,7 +567,7 @@ static void read_nan(ParseInfo pi) {
         ni.bigdec_load = pi->options.compat_bigdec;
     } else {
         ni.no_big      = (FloatDec == pi->options.bigdec_load || FastDec == pi->options.bigdec_load ||
-                     RubyDec == pi->options.bigdec_load);
+                          RubyDec == pi->options.bigdec_load);
         ni.bigdec_load = pi->options.bigdec_load;
     }
 
@@ -745,6 +747,7 @@ void oj_sparse2(ParseInfo pi) {
                     oj_set_error_at(pi, oj_parse_error_class, __FILE__, __LINE__, "expected NaN");
                     return;
                 }
+                ni.pi       = pi;
                 ni.str      = pi->rd.str;
                 ni.i        = 0;
                 ni.num      = 0;
@@ -761,7 +764,7 @@ void oj_sparse2(ParseInfo pi) {
                     ni.bigdec_load = pi->options.compat_bigdec;
                 } else {
                     ni.no_big      = (FloatDec == pi->options.bigdec_load || FastDec == pi->options.bigdec_load ||
-                                 RubyDec == pi->options.bigdec_load);
+                                      RubyDec == pi->options.bigdec_load);
                     ni.bigdec_load = pi->options.bigdec_load;
                 }
                 add_num_value(pi, &ni);
@@ -903,7 +906,17 @@ CLEANUP:
     if (0 != pi->circ_array) {
         oj_circ_array_free(pi->circ_array);
     }
+    reader_cleanup(&pi->rd);
     stack_cleanup(&pi->stack);
+    // A :match_string option builds a chain of regexps for this call that has to
+    // be freed. Without the option the member aliases the chain owned by the
+    // defaults and must be left alone.
+    if (pi->options.str_rx.head != oj_default_options.str_rx.head) {
+        oj_rxclass_cleanup(&pi->options.str_rx);
+        pi->options.str_rx.head = NULL;
+        pi->options.str_rx.tail = NULL;
+    }
+    oj_free_call_options(&pi->options);
     if (0 != fd) {
 #ifdef _WIN32
         rb_w32_close(fd);

data/ext/oj/stream_writer.c

@@ -16,15 +16,29 @@ static void stream_writer_free(void *ptr) {
         return;
     }
     sw = (StreamWriter)ptr;
+    oj_options_release(&sw->sw.opts);
     OJ_R_FREE(sw->sw.out.buf);
     OJ_R_FREE(sw->sw.types);
     OJ_R_FREE(ptr);
 }
 
+static void stream_writer_mark(void *ptr) {
+    if (NULL != ptr) {
+        StreamWriter sw = (StreamWriter)ptr;
+
+        oj_options_mark(&sw->sw.opts);
+        // The writer can be the only reference to the stream as in
+        // Oj::StreamWriter.new(StringIO.new) so it must be marked.
+        if (Qnil != sw->stream) {
+            rb_gc_mark(sw->stream);
+        }
+    }
+}
+
 static const rb_data_type_t oj_stream_writer_type = {
     "Oj/stream_writer",
     {
-        NULL,
+        stream_writer_mark,
         stream_writer_free,
         NULL,
     },
@@ -116,6 +130,7 @@ static VALUE stream_writer_new(int argc, VALUE *argv, VALUE self) {
         oj_str_writer_init(&sw->sw, 4096);
         sw->flush_limit = 0;
     }
+    oj_options_take_ownership(&sw->sw.opts);
     sw->sw.out.indent = sw->sw.opts.indent;
     sw->stream        = stream;
     sw->type          = type;

data/ext/oj/string_writer.c

@@ -42,12 +42,18 @@ static void maybe_comma(StrWriter sw) {
 
 // Used by stream writer also.
 void oj_str_writer_init(StrWriter sw, int buf_size) {
-    sw->opts       = oj_default_options;
-    sw->depth      = 0;
-    sw->types      = OJ_R_ALLOC_N(char, 256);
-    sw->types_end  = sw->types + 256;
-    *sw->types     = '\0';
-    sw->keyWritten = 0;
+    sw->opts = oj_default_options;
+    // Detach from the match_string regexps owned by the defaults before the
+    // options are parsed. A :match_string option then builds a chain of its own
+    // that is freed with the writer instead of being appended to the chain the
+    // defaults are using.
+    sw->opts.str_rx.head = NULL;
+    sw->opts.str_rx.tail = NULL;
+    sw->depth            = 0;
+    sw->types            = OJ_R_ALLOC_N(char, 256);
+    sw->types_end        = sw->types + 256;
+    *sw->types           = '\0';
+    sw->keyWritten       = 0;
 
     if (0 == buf_size) {
         buf_size = 4096;
@@ -72,6 +78,8 @@ void oj_str_writer_init(StrWriter sw, int buf_size) {
     sw->out.argv       = NULL;
     sw->out.ropts      = NULL;
     sw->out.omit_nil   = oj_default_options.dump_opts.omit_nil;
+    // oj_str_writer_init does not call oj_out_init, so clear this here too.
+    sw->out.key_filter_off = false;
 }
 
 void oj_str_writer_push_key(StrWriter sw, const char *key) {
@@ -234,15 +242,22 @@ static void string_writer_free(void *ptr) {
     sw = (StrWriter)ptr;
 
     oj_out_free(&sw->out);
+    oj_options_release(&sw->opts);
 
     OJ_R_FREE(sw->types);
     OJ_R_FREE(ptr);
 }
 
+static void string_writer_mark(void *ptr) {
+    if (NULL != ptr) {
+        oj_options_mark(&((StrWriter)ptr)->opts);
+    }
+}
+
 static const rb_data_type_t oj_string_writer_type = {
     "Oj/string_writer",
     {
-        NULL,
+        string_writer_mark,
         string_writer_free,
         NULL,
     },
@@ -279,6 +294,7 @@ static VALUE str_writer_new(int argc, VALUE *argv, VALUE self) {
     if (1 == argc) {
         oj_parse_options(argv[0], &sw->opts);
     }
+    oj_options_take_ownership(&sw->opts);
     sw->out.argc   = argc - 1;
     sw->out.argv   = argv + 1;
     sw->out.indent = sw->opts.indent;

data/ext/oj/usual.c

@@ -63,7 +63,7 @@ static VALUE form_attr(const char *str, size_t len) {
         memcpy(b + 1, str, len);
         b[len + 1] = '\0';
 
-        id = rb_intern3(buf, len + 1, oj_utf8_encoding);
+        id = rb_intern3(b, len + 1, oj_utf8_encoding);
         OJ_R_FREE(b);
         return id;
     }
@@ -200,7 +200,10 @@ static void push_key(ojParser p) {
         d->ktail = d->khead + pos;
         d->kend  = d->khead + cap;
     }
-    d->ktail->len = klen;
+    if (32000 < klen) {
+        rb_raise(oj_json_parser_error_class, "Key too long. Keys are limited to 32,000 bytes.");
+    }
+    d->ktail->len = (int16_t)klen;
     if (klen < sizeof(d->ktail->buf)) {
         memcpy(d->ktail->buf, key, klen);
         d->ktail->buf[klen] = '\0';
@@ -608,12 +611,16 @@ static void dfree(ojParser p) {
     Usual d = (Usual)p->ctx;
 
     cache_free(d->str_cache);
+    d->str_cache = NULL;
     cache_free(d->attr_cache);
+    d->attr_cache = NULL;
     if (NULL != d->sym_cache) {
         cache_free(d->sym_cache);
+        d->sym_cache = NULL;
     }
     if (NULL != d->class_cache) {
         cache_free(d->class_cache);
+        d->class_cache = NULL;
     }
     OJ_R_FREE(d->vhead);
     OJ_R_FREE(d->chead);
@@ -640,6 +647,12 @@ static void mark(ojParser p) {
     if (NULL != d->class_cache) {
         cache_mark(d->class_cache);
     }
+    if (Qnil != d->hash_class) {
+        rb_gc_mark(d->hash_class);
+    }
+    if (Qnil != d->array_class) {
+        rb_gc_mark(d->array_class);
+    }
     for (vp = d->vhead; vp < d->vtail; vp++) {
         if (Qundef != *vp) {
             rb_gc_mark(*vp);
@@ -818,6 +831,7 @@ static VALUE opt_create_id_set(ojParser p, VALUE value) {
     Usual d = (Usual)p->ctx;
 
     if (Qnil == value) {
+        OJ_R_FREE(d->create_id);
         d->create_id                 = NULL;
         d->create_id_len             = 0;
         p->funcs[OBJECT_FUN].add_str = add_str_key;
@@ -837,12 +851,15 @@ static VALUE opt_create_id_set(ojParser p, VALUE value) {
         if (1 << (8 * sizeof(d->create_id_len)) <= len) {
             rb_raise(rb_eArgError, "The create_id values is limited to %d bytes.", 1 << (8 * sizeof(d->create_id_len)));
         }
-        d->create_id_len                  = (uint8_t)len;
+        char *prev = d->create_id;
+
         d->create_id                      = str_dup(RSTRING_PTR(value), len);
+        d->create_id_len                  = (uint8_t)len;
         p->funcs[OBJECT_FUN].add_str      = add_str_key_create;
         p->funcs[TOP_FUN].close_object    = close_object_create;
         p->funcs[ARRAY_FUN].close_object  = close_object_create;
         p->funcs[OBJECT_FUN].close_object = close_object_create;
+        OJ_R_FREE(prev);
     }
     return opt_create_id(p, value);
 }
@@ -1050,10 +1067,10 @@ static VALUE opt_symbol_keys_set(ojParser p, VALUE value) {
         if (NULL != d->sym_cache) {
             cache_free(d->sym_cache);
             d->sym_cache = NULL;
+            d->key_cache = NULL;
         }
-        if (!d->cache_keys) {
-            d->get_key = str_key;
-        }
+        d->cache_keys = false;
+        d->get_key    = str_key;
     }
     return (NULL != d->sym_cache) ? Qtrue : Qfalse;
 }

data/ext/oj/util.c

@@ -134,3 +134,30 @@ void sec_as_time(int64_t secs, TimeInfo ti) {
     secs     = secs - (int64_t)ti->min * 60LL;
     ti->sec  = (int)secs;
 }
+
+// The inverse of sec_as_time(). The days are counted with the civil calendar
+// algorithm from Howard Hinnant's date library so that no libc call is needed.
+// timegm() is not available on Windows and the mktime() based replacement that
+// was used there returned the wrong value in any timezone east of UTC.
+int64_t time_as_sec(TimeInfo ti) {
+    int64_t year = (int64_t)ti->year;
+    int64_t mon  = (int64_t)ti->mon;
+    int64_t era;
+    int64_t yoe;   // year of the era, [0, 399]
+    int64_t doy;   // day of the year, [0, 365]
+    int64_t doe;   // day of the era, [0, 146096]
+    int64_t days;  // days since 1970-01-01
+
+    // Start the year on March 1st so that a leap day falls on the last day of
+    // the year and the day of the year is a simple expression.
+    if (mon <= 2) {
+        year--;
+    }
+    era  = (0 <= year ? year : year - 399) / 400;
+    yoe  = year - era * 400;
+    doy  = (153 * (mon + (2 < mon ? -3 : 9)) + 2) / 5 + (int64_t)ti->day - 1;
+    doe  = yoe * 365 + yoe / 4 - yoe / 100 + doy;
+    days = era * 146097 + doe - 719468;
+
+    return days * SECS_PER_DAY + (int64_t)ti->hour * 3600LL + (int64_t)ti->min * 60LL + (int64_t)ti->sec;
+}

data/ext/oj/util.h

@@ -15,6 +15,7 @@ typedef struct _timeInfo {
     int year;
 }* TimeInfo;
 
-extern void sec_as_time(int64_t secs, TimeInfo ti);
+extern void    sec_as_time(int64_t secs, TimeInfo ti);
+extern int64_t time_as_sec(TimeInfo ti);
 
 #endif /* OJ_UTIL_H */

data/ext/oj/val_stack.h

@@ -35,8 +35,8 @@ typedef struct _val {
     const char    *classname;
     VALUE          clas;
     OddArgs        odd_args;
-    uint16_t       klen;
-    uint16_t       clen;
+    size_t         klen;
+    size_t         clen;
     char           next;  // ValNext
     char           k1;    // first original character in the key
     char           kalloc;
@@ -62,6 +62,16 @@ inline static int stack_empty(ValStack stack) {
 }
 
 inline static void stack_cleanup(ValStack stack) {
+    Val v;
+
+    // end_hash() frees the args of a completed odd class. Anything still here
+    // belongs to a parse that was abandoned part way through.
+    for (v = stack->head; v < stack->tail; v++) {
+        if (NULL != v->odd_args) {
+            oj_odd_free(v->odd_args);
+            v->odd_args = NULL;
+        }
+    }
     if (stack->base != stack->head) {
         OJ_R_FREE(stack->head);
         stack->head = NULL;
@@ -70,9 +80,11 @@ inline static void stack_cleanup(ValStack stack) {
 
 inline static void stack_push(ValStack stack, VALUE val, ValNext next) {
     if (stack->end <= stack->tail) {
-        size_t len  = stack->end - stack->head;
-        size_t toff = stack->tail - stack->head;
-        Val    head = stack->head;
+        size_t      len  = stack->end - stack->head;
+        size_t      toff = stack->tail - stack->head;
+        Val         head = stack->head;
+        const char *old  = (const char *)stack->head;
+        size_t      i;
 
         // A realloc can trigger a GC so make sure it happens outside the lock
         // but lock before changing pointers.
@@ -82,6 +94,13 @@ inline static void stack_push(ValStack stack, VALUE val, ValNext next) {
         } else {
             OJ_R_REALLOC_N(head, struct _val, len + STACK_INC);
         }
+        // A key short enough to be kept in the Val itself points into the
+        // block that just moved.
+        for (i = 0; i < toff; i++) {
+            if (old <= head[i].key && head[i].key < old + sizeof(struct _val) * len) {
+                head[i].key = head[i].karray;
+            }
+        }
 #ifdef HAVE_PTHREAD_MUTEX_INIT
         pthread_mutex_lock(&stack->mutex);
 #else

data/ext/oj/wab.c

@@ -19,7 +19,7 @@
 // Workaround in case INFINITY is not defined in math.h or if the OS is CentOS
 #define OJ_INFINITY (1.0 / 0.0)
 
-static char hex_chars[256] = "\
+static char hex_chars[257] = "\
 ................................\
 ................xxxxxxxxxx......\
 .xxxxxx.........................\
@@ -375,44 +375,41 @@ static const char *read_num(const char *s, int len, int *vp) {
 }
 
 static VALUE time_parse(const char *s, int len) {
-    struct tm tm;
-    bool      neg   = false;
-    long      nsecs = 0;
-    int       i;
-    time_t    secs;
+    struct _timeInfo ti;
+    bool             neg   = false;
+    long             nsecs = 0;
+    int              i;
 
-    memset(&tm, 0, sizeof(tm));
+    memset(&ti, 0, sizeof(ti));
     if ('-' == *s) {
         s++;
         neg = true;
     }
-    if (NULL == (s = read_num(s, 4, &tm.tm_year))) {
+    if (NULL == (s = read_num(s, 4, &ti.year))) {
         return Qnil;
     }
     if (neg) {
-        tm.tm_year = -tm.tm_year;
-        neg        = false;
+        ti.year = -ti.year;
+        neg     = false;
     }
-    tm.tm_year -= 1900;
     s++;
-    if (NULL == (s = read_num(s, 2, &tm.tm_mon))) {
+    if (NULL == (s = read_num(s, 2, &ti.mon))) {
         return Qnil;
     }
-    tm.tm_mon--;
     s++;
-    if (NULL == (s = read_num(s, 2, &tm.tm_mday))) {
+    if (NULL == (s = read_num(s, 2, &ti.day))) {
         return Qnil;
     }
     s++;
-    if (NULL == (s = read_num(s, 2, &tm.tm_hour))) {
+    if (NULL == (s = read_num(s, 2, &ti.hour))) {
         return Qnil;
     }
     s++;
-    if (NULL == (s = read_num(s, 2, &tm.tm_min))) {
+    if (NULL == (s = read_num(s, 2, &ti.min))) {
         return Qnil;
     }
     s++;
-    if (NULL == (s = read_num(s, 2, &tm.tm_sec))) {
+    if (NULL == (s = read_num(s, 2, &ti.sec))) {
         return Qnil;
     }
     s++;
@@ -424,16 +421,7 @@ static VALUE time_parse(const char *s, int len) {
             return Qnil;
         }
     }
-#if IS_WINDOWS
-    secs = (time_t)mktime(&tm);
-    memset(&tm, 0, sizeof(tm));
-    tm.tm_year = 70;
-    tm.tm_mday = 1;
-    secs -= (time_t)mktime(&tm);
-#else
-    secs = (time_t)timegm(&tm);
-#endif
-    return rb_funcall(rb_time_nano_new(secs, nsecs), oj_utc_id, 0);
+    return rb_funcall(rb_time_nano_new((time_t)time_as_sec(&ti), nsecs), oj_utc_id, 0);
 }
 
 static VALUE protect_uri(VALUE rstr) {

data/lib/oj/version.rb

@@ -1,4 +1,4 @@
 module Oj
   # Current version of the module.
-  VERSION = '3.16.11'
+  VERSION = '3.17.6'
 end

data/pages/Compatibility.md

@@ -2,7 +2,7 @@
 
 **Ruby**
 
-Oj is compatible with Ruby 2.4+ and RBX.
+Oj is compatible with Ruby 2.7+ and RBX.
 Support for JRuby has been removed as JRuby no longer supports C extensions and
 there are bugs in the older versions that are not being fixed.
 

data/pages/Custom.md

@@ -8,9 +8,8 @@ for object dumping and loading. The `:compat` mode mimic the json gem
 including methods called for encoding and inconsistencies between
 `JSON.dump()`, `JSON.generate()`, and `JSON()`.
 
-The `:custom` mode is the default mode. It can be configured either by passing
-options to the `Oj.dump()` and `Oj.load()` methods or by modifying the default
-options.
+The `:custom` mode can be configured either by passing options to the
+`Oj.dump()` and `Oj.load()` methods or by modifying the default options.
 
 The ability to create objects from JSON object elements is supported and
 considers the `:create_additions` option. Special treatment is given to the

data/pages/InstallOptions.md

@@ -10,11 +10,13 @@ To enable Oj trace feature, it uses `--enable-trace-log` option when installing
 Then, the trace logs will be displayed when `:trace` option is set to `true`.
 
 
-### Enable SIMD instructions
+### SIMD instructions
 
-```
-$ gem install oj -- --with-sse42
-```
+SIMD optimizations are enabled automatically, so no install option is
+required. At runtime Oj detects the CPU features that are available and
+selects the best implementation: SSE4.2 or SSE2 on x86 / x86_64, NEON on ARM,
+and a scalar fallback when none is available.
 
-To enable the use of SIMD instructions in Oj, it uses the `--with-sse42` option when installing the gem.
-This will enable the use of the SSE4.2 instructions in the internal.
+Earlier versions required a `--with-sse42` option at install time to turn on
+SSE4.2. That option has been removed (#982); SSE4.2 is now selected
+automatically when the CPU supports it.

data/pages/Modes.md

@@ -121,7 +121,7 @@ information.
 | :object_nl             | String  |         |         |       x |       x |         |       x |         |
 | :omit_nil              | Boolean |       x |       x |       x |       x |       x |       x |         |
 | :quirks_mode           | Boolean |         |         |       6 |         |         |       x |         |
-| :safe                  | String  |         |         |       x |         |         |         |         |
+| :safe                  | Boolean |         |         |       x |         |         |         |         |
 | :second_precision      | Fixnum  |         |         |         |         |       x |       x |         |
 | :space                 | String  |         |         |       x |       x |         |       x |         |
 | :space_before          | String  |         |         |       x |       x |         |       x |         |

data/pages/Options.md

@@ -213,8 +213,7 @@ for json gem compatibility.
 
 Primary behavior for loading and dumping. The :mode option controls which
 other options are in effect. For more details see the {file:Modes.md} page. By
-default Oj uses the :custom mode which is provides the highest degree of
-customization.
+default Oj uses the :object mode.
 
 ### :nan [Symbol]
 
@@ -249,6 +248,10 @@ integer gives better performance.
 
 If true, Hash and Object attributes with nil values are omitted.
 
+### :omit_null_byte [Boolean]
+
+If true, null bytes in strings will be omitted when dumping.
+
 ### :quirks_mode [Boolean]
 
 Allow single JSON values instead of documents, default is true (allow). This
@@ -265,10 +268,6 @@ to true.
 
 The number of digits after the decimal when dumping the seconds of time.
 
-### :skip_null_byte [Boolean]
-
-If true, null bytes in strings will be omitted when dumping.
-
 ### :space
 
 String inserted after the ':' character when dumping a JSON object. The

data/pages/Parser.md

@@ -280,7 +280,7 @@ Oj::Parser.usual       0.452      110544.876
        JSON::Ext       1.009       49555.094
 ```
 
-The `Oj::Parser.new(:saj)` is **1.55** times faster than `Oj.load` and
+The `Oj::Parser.new(:usual)` is **1.55** times faster than `Oj.load` and
 **2.23** times faster than the JSON gem.
 
 ### Object
@@ -298,7 +298,7 @@ Oj::Parser.usual       0.071      703502.033
        JSON::Ext       0.401      124638.859
 ```
 
-The `Oj::Parser.new(:saj)` is **3.17** times faster than
+The `Oj::Parser.new(:usual)` is **3.17** times faster than
 `Oj.compat_load` and **5.64** times faster than the JSON gem.
 
 ## Summary

data/pages/Rails.md

@@ -89,6 +89,12 @@ The classes that can be put in optimized mode and are optimized when
  * any class inheriting from ActiveRecord::Base
  * any other class where all attributes should be dumped
 
+Both `Oj::Rails` and each `Oj::Rails::Encoder` have `optimize()`, `deoptimize()`, and `optimized?()` methods. The module level methods change the setting for the whole process. An encoder follows those process wide settings until `optimize()` or `deoptimize()` is called on the encoder itself. From then on the encoder keeps a set of its own and later module level changes do not reach it.
+
+Options work the same way. An encoder reads `Oj.default_options` when it encodes, so later changes to the defaults reach it, unless it was given options of its own, in which case it keeps the copy it took when it was created. An encoder counts as having options of its own only if the hash it was built with names at least one option Oj knows. A hash of nothing but keys Oj does not have, such as the `escape: false` ActiveSupport 8.1 builds one of its cached encoders with, leaves the encoder on the defaults.
+
+Once a class is optimized its `as_json()` method is no longer called, so an application that defines its own `as_json()` on an optimized class, `BigDecimal` for example, will not see it used. Call `Oj::Rails.deoptimize(BigDecimal)` after `Oj.optimize_rails` to put that one class back on the `as_json()` path and leave the rest optimized.
+
 The ActiveSupport decoder is the `JSON.parse()` method. Calling the
 `Oj::Rails.set_decoder()` method replaces that method with the Oj equivalent.
 

data/pages/Security.md

@@ -11,10 +11,24 @@ auto defined is used with an untrusted source. The `Oj.safe_load()` method
 sets and uses the most strict and safest options. It should be used by
 developers who find it difficult to understand the options available in Oj.
 
-The options in Oj are designed to provide flexibility to the developer. This
-flexibility allows Objects to be serialized and deserialized. No methods are
-ever called on these created Objects but that does not stop the developer from
-calling methods on them. As in any system, check your inputs before working with
-them. Taking an arbitrary `String` from a user and evaluating it is never a good
-idea from an unsecure source. The same is true for `Object` attributes as they
-are not more than `String`s. Always check inputs from untrusted sources.
+The options in Oj are designed to provide flexibility to the developer. This flexibility allows Objects to be serialized and deserialized. An Object is deserialized by allocating it without calling its initializer and then setting its instance variables. A few methods are called on what that builds: `exception` and `set_backtrace` on an `Exception`, and `replace` on a subclass of `Hash`, `Array` or `String` for a `self` key. As in any system, check your inputs before working with them. Taking an arbitrary `String` from a user and evaluating it is never a good idea from an unsecure source. The same is true for `Object` attributes as they are not more than `String`s. Always check inputs from untrusted sources.
+
+## The mode a document is loaded in
+
+`Oj.load()` uses the `:object` mode unless the mode is changed. That mode takes the class of an Object from the document, so the document decides which of the classes already loaded in the process is allocated and what its instance variables are. Classes are looked up and not created unless `:auto_define` is turned on.
+
+For a document from an untrusted source, ask for a mode that does not do that:
+
+```ruby
+Oj.load(json, mode: :strict)
+Oj.strict_load(json)
+Oj.safe_load(json)
+```
+
+or set it for the process:
+
+```ruby
+Oj.default_options = {mode: :strict}
+```
+
+`Oj.object_load()` is the explicit form of the current default and stays in `:object` mode whatever the default is set to.