std.json: JSONValue allows violating constness

[dlangBugzillaToGithub]

default_357-line (@FeepingCreature) reported this on 2018-09-21T08:50:32Z

Transfered from https://issues.dlang.org/show_bug.cgi?id=19256

CC List

• bugzilla (@WalterBright)

Description

Consider the following code:

import std.json;

@safe unittest {
    const JSONValue innerObj = JSONValue(["foo": JSONValue(1)]);

    assert(innerObj["foo"] == JSONValue(1));

    // Why can I do this??
    JSONValue value = innerObj;

    value["foo"] = JSONValue(2);

    assert(innerObj["foo"] == JSONValue(1));
}

innerObj is changed, even though we access it through a const variable.

This should not be allowed.

[dlangBugzillaToGithub]

default_357-line (@FeepingCreature) commented on 2018-09-21T09:03:49Z

See also bug 12885. https://issues.dlang.org/show_bug.cgi?id=12885

This bug is still relevant, as it happens in @safe code, not just @system - std.json violates @trusted by allowing bad things to happen.

[dlangBugzillaToGithub]

bugzilla (@WalterBright) commented on 2018-12-16T10:33:14Z

Is this a duplicate of 12885 then?

[dlangBugzillaToGithub]

default_357-line (@FeepingCreature) commented on 2018-12-16T13:36:22Z

I'd call it a consequence or subset of 12885, in that fixing 12885 also fixes this.

But if 12885 was closed wontfix, this one would still need a separate fix.

[dlangBugzillaToGithub]

dlang-bot commented on 2019-05-17T05:14:44Z

@FeepingCreature updated dlang/phobos pull request #6716 "Fix issue 19256: prevent JSONValue const conversion" fixing this issue:

- std.json: Fix issue 19256, prevent auto JSONValue = const(JSONValue)
  Reorder JSONValue's union members to make dmd realize that JSONValue contains const references and disallows reassigning const(JSONValue) to JSONValue, which would break constness.
  This works around https://issues.dlang.org/show_bug.cgi?id=12885 .

https://github.com/dlang/phobos/pull/6716