Skip to content

Audit fixes#383

Merged
SimonCropp merged 2 commits into
mainfrom
audit-fixes
Jul 13, 2026
Merged

Audit fixes#383
SimonCropp merged 2 commits into
mainfrom
audit-fixes

Conversation

@SimonCropp

Copy link
Copy Markdown
Member

No description provided.

Correctness:
- DefaultJsonNameTable.Add: lock a dedicated object, not the entries array
  that Grow() replaces (mutual exclusion broke across a table resize)
- JTokenWriter: add missing WriteValue/WritePropertyName(CharSpan) overrides
  (span writes silently corrupted the token tree)
- JsonPath: '&&' now binds tighter than '||' (RFC 9535). BREAKING: changes
  results for mixed-operator filters; updated the pinned FilterExistWithAndOr test
- JsonTextWriter: add WriteComment/WriteWhitespace(CharSpan) overrides
- JTokenWriter: WriteValue((byte[])null)/((Uri)null) now writes a single null
- DefaultContractResolver: Fields mode includes inherited private fields
- ImmutableCollectionsUtils: IImmutableQueue<> maps to concrete ImmutableQueue<>
- JContainer copy ctor: copy line info from the source, not the fresh clone
- JsonPath: malformed paths throw JsonException, not IndexOutOfRangeException;
  '&&||' is rejected; '=~' without slashes throws at parse time
- JsonTextReader: reject bufferSize <= 0
- Converters: non-string tokens reported with JSON position info; PathInfoConverter
  no longer drops non-string tokens to null
- TryGetImmutableConstructor: try all constructors instead of aborting on the first
- DefaultContractResolver.Converters: expose as IReadOnlyList. BREAKING: no longer
  a mutable List
- JValue: char- and string-backed String values hash consistently

Performance:
- JavaScriptUtils/JsonPosition: return the pooled escape buffer; size StringWriter
  for delimiters
- CamelCasePropertyNamesContractResolver: struct cache key (0 alloc per probe, 2x faster)
- EnumUtils: cache the enum underlying type code on EnumInfo
- BooleanQueryExpression: parse the =~ regex once at construction
- FSharpMapConverter: wrap the map in a ReadOnlyDictionary view instead of copying

Tests and benchmarks:
- AuditFindingsTests + JPath parse-error tests (regression tests per fix)
- AuditPerfBenchmarks; Benchmark.Tests retargeted to net10.0
@SimonCropp SimonCropp merged commit b1ae7c9 into main Jul 13, 2026
2 of 4 checks passed
@SimonCropp SimonCropp deleted the audit-fixes branch July 13, 2026 01:58
@SimonCropp SimonCropp added this to the 0.35.1 milestone Jul 13, 2026
This was referenced Jul 13, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Development

Successfully merging this pull request may close these issues.

1 participant