oj 3.17.3 → 3.17.6

data/pages/Modes.md

@@ -121,7 +121,7 @@ information.
 | :object_nl             | String  |         |         |       x |       x |         |       x |         |
 | :omit_nil              | Boolean |       x |       x |       x |       x |       x |       x |         |
 | :quirks_mode           | Boolean |         |         |       6 |         |         |       x |         |
-| :safe                  | String  |         |         |       x |         |         |         |         |
+| :safe                  | Boolean |         |         |       x |         |         |         |         |
 | :second_precision      | Fixnum  |         |         |         |         |       x |       x |         |
 | :space                 | String  |         |         |       x |       x |         |       x |         |
 | :space_before          | String  |         |         |       x |       x |         |       x |         |

data/pages/Options.md

@@ -213,8 +213,7 @@ for json gem compatibility.
 
 Primary behavior for loading and dumping. The :mode option controls which
 other options are in effect. For more details see the {file:Modes.md} page. By
-default Oj uses the :custom mode which is provides the highest degree of
-customization.
+default Oj uses the :object mode.
 
 ### :nan [Symbol]
 
@@ -249,6 +248,10 @@ integer gives better performance.
 
 If true, Hash and Object attributes with nil values are omitted.
 
+### :omit_null_byte [Boolean]
+
+If true, null bytes in strings will be omitted when dumping.
+
 ### :quirks_mode [Boolean]
 
 Allow single JSON values instead of documents, default is true (allow). This
@@ -265,10 +268,6 @@ to true.
 
 The number of digits after the decimal when dumping the seconds of time.
 
-### :skip_null_byte [Boolean]
-
-If true, null bytes in strings will be omitted when dumping.
-
 ### :space
 
 String inserted after the ':' character when dumping a JSON object. The

data/pages/Parser.md

@@ -280,7 +280,7 @@ Oj::Parser.usual       0.452      110544.876
        JSON::Ext       1.009       49555.094
 ```
 
-The `Oj::Parser.new(:saj)` is **1.55** times faster than `Oj.load` and
+The `Oj::Parser.new(:usual)` is **1.55** times faster than `Oj.load` and
 **2.23** times faster than the JSON gem.
 
 ### Object
@@ -298,7 +298,7 @@ Oj::Parser.usual       0.071      703502.033
        JSON::Ext       0.401      124638.859
 ```
 
-The `Oj::Parser.new(:saj)` is **3.17** times faster than
+The `Oj::Parser.new(:usual)` is **3.17** times faster than
 `Oj.compat_load` and **5.64** times faster than the JSON gem.
 
 ## Summary

data/pages/Rails.md

@@ -89,6 +89,12 @@ The classes that can be put in optimized mode and are optimized when
  * any class inheriting from ActiveRecord::Base
  * any other class where all attributes should be dumped
 
+Both `Oj::Rails` and each `Oj::Rails::Encoder` have `optimize()`, `deoptimize()`, and `optimized?()` methods. The module level methods change the setting for the whole process. An encoder follows those process wide settings until `optimize()` or `deoptimize()` is called on the encoder itself. From then on the encoder keeps a set of its own and later module level changes do not reach it.
+
+Options work the same way. An encoder reads `Oj.default_options` when it encodes, so later changes to the defaults reach it, unless it was given options of its own, in which case it keeps the copy it took when it was created. An encoder counts as having options of its own only if the hash it was built with names at least one option Oj knows. A hash of nothing but keys Oj does not have, such as the `escape: false` ActiveSupport 8.1 builds one of its cached encoders with, leaves the encoder on the defaults.
+
+Once a class is optimized its `as_json()` method is no longer called, so an application that defines its own `as_json()` on an optimized class, `BigDecimal` for example, will not see it used. Call `Oj::Rails.deoptimize(BigDecimal)` after `Oj.optimize_rails` to put that one class back on the `as_json()` path and leave the rest optimized.
+
 The ActiveSupport decoder is the `JSON.parse()` method. Calling the
 `Oj::Rails.set_decoder()` method replaces that method with the Oj equivalent.
 

data/pages/Security.md

@@ -11,10 +11,24 @@ auto defined is used with an untrusted source. The `Oj.safe_load()` method
 sets and uses the most strict and safest options. It should be used by
 developers who find it difficult to understand the options available in Oj.
 
-The options in Oj are designed to provide flexibility to the developer. This
-flexibility allows Objects to be serialized and deserialized. No methods are
-ever called on these created Objects but that does not stop the developer from
-calling methods on them. As in any system, check your inputs before working with
-them. Taking an arbitrary `String` from a user and evaluating it is never a good
-idea from an unsecure source. The same is true for `Object` attributes as they
-are not more than `String`s. Always check inputs from untrusted sources.
+The options in Oj are designed to provide flexibility to the developer. This flexibility allows Objects to be serialized and deserialized. An Object is deserialized by allocating it without calling its initializer and then setting its instance variables. A few methods are called on what that builds: `exception` and `set_backtrace` on an `Exception`, and `replace` on a subclass of `Hash`, `Array` or `String` for a `self` key. As in any system, check your inputs before working with them. Taking an arbitrary `String` from a user and evaluating it is never a good idea from an unsecure source. The same is true for `Object` attributes as they are not more than `String`s. Always check inputs from untrusted sources.
+
+## The mode a document is loaded in
+
+`Oj.load()` uses the `:object` mode unless the mode is changed. That mode takes the class of an Object from the document, so the document decides which of the classes already loaded in the process is allocated and what its instance variables are. Classes are looked up and not created unless `:auto_define` is turned on.
+
+For a document from an untrusted source, ask for a mode that does not do that:
+
+```ruby
+Oj.load(json, mode: :strict)
+Oj.strict_load(json)
+Oj.safe_load(json)
+```
+
+or set it for the process:
+
+```ruby
+Oj.default_options = {mode: :strict}
+```
+
+`Oj.object_load()` is the explicit form of the current default and stays in `:object` mode whatever the default is set to.

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: oj
 version: !ruby/object:Gem::Version
-  version: 3.17.3
+  version: 3.17.6
 platform: ruby
 authors:
 - Peter Ohler
@@ -231,7 +231,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 4.0.3
+rubygems_version: 4.0.17
 specification_version: 4
 summary: A fast JSON parser and serializer.
 test_files: []