This commit is contained in:
nlohmann committed 2026-10-12 07:35:31 +00:00
1 parent 79119509a9
commit 22fba27145
555 files changed
+17342 -1394

No files matched your search

+2 -2
View File
@@ -1,8 +1,8 @@
<!doctype html><html lang=en class=no-js> <head><meta charset=utf-8><meta name=viewport content="width=device-width,initial-scale=1"><meta name=author content="Niels Lohmann"><link href="https://json.nlohmann.me/community/assurance_case/" rel="canonical"><link href=../security_policy/ rel=prev><link rel=icon href=../../assets/images/favicon.png><meta name=generator content="mkdocs-1.6.1, mkdocs-material-9.7.7"><title>Assurance case - JSON for Modern C++</title><link rel=stylesheet href=../../assets/stylesheets/main.ec1eaa64.min.css><link rel=stylesheet href=../../assets/stylesheets/palette.ab4e12ef.min.css><link rel="stylesheet" href="../../assets/external/fonts.googleapis.com/css.61a430c9.css"><style>:root{--md-text-font:"Roboto";--md-code-font:"JetBrains Mono"}</style><link rel=stylesheet href=../../css/custom.css><script>__md_scope=new URL("../..",location),__md_hash=e=>[...e].reduce(((e,_)=>(e<<5)-e+_.charCodeAt(0)),0),__md_get=(e,_=localStorage,t=__md_scope)=>JSON.parse(_.getItem(t.pathname+"."+e)),__md_set=(e,_,t=localStorage,a=__md_scope)=>{try{t.setItem(a.pathname+"."+e,JSON.stringify(_))}catch(e){}}</script></head> <body dir=ltr data-md-color-scheme=default data-md-color-primary=indigo data-md-color-accent=indigo> <input class=md-toggle data-md-toggle=drawer type=checkbox id=__drawer autocomplete=off> <input class=md-toggle data-md-toggle=search type=checkbox id=__search autocomplete=off> <label class=md-overlay for=__drawer></label> <div data-md-component=skip> <a href=#assurance-case class=md-skip> Skip to content </a> </div> <div data-md-component=announce> </div> <header class=md-header data-md-component=header> <nav class="md-header__inner md-grid" aria-label=Header> <a href=../.. title="JSON for Modern C++" class="md-header__button md-logo" aria-label="JSON for Modern C++" data-md-component=logo> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M12 8a3 3 0 0 0 3-3 3 3 0 0 0-3-3 3 3 0 0 0-3 3 3 3 0 0 0 3 3m0 3.54C9.64 9.35 6.5 8 3 8v11c3.5 0 6.64 1.35 9 3.54 2.36-2.19 5.5-3.54 9-3.54V8c-3.5 0-6.64 1.35-9 3.54"/></svg> </a> <label class="md-header__button md-icon" for=__drawer> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M3 6h18v2H3zm0 5h18v2H3zm0 5h18v2H3z"/></svg> </label> <div class=md-header__title data-md-component=header-title> <div class=md-header__ellipsis> <div class=md-header__topic> <span class=md-ellipsis> JSON for Modern C++ </span> </div> <div class=md-header__topic data-md-component=header-topic> <span class=md-ellipsis> Assurance case </span> </div> </div> </div> <form class=md-header__option data-md-component=palette> <input class=md-option data-md-color-media="(prefers-color-scheme: light)" data-md-color-scheme=default data-md-color-primary=indigo data-md-color-accent=indigo aria-label="Switch to dark mode" type=radio name=__palette id=__palette_0> <label class="md-header__button md-icon" title="Switch to dark mode" for=__palette_1 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M12 8a4 4 0 0 0-4 4 4 4 0 0 0 4 4 4 4 0 0 0 4-4 4 4 0 0 0-4-4m0 10a6 6 0 0 1-6-6 6 6 0 0 1 6-6 6 6 0 0 1 6 6 6 6 0 0 1-6 6m8-9.31V4h-4.69L12 .69 8.69 4H4v4.69L.69 12 4 15.31V20h4.69L12 23.31 15.31 20H20v-4.69L23.31 12z"/></svg> </label> <input class=md-option data-md-color-media="(prefers-color-scheme: dark)" data-md-color-scheme=slate data-md-color-primary=indigo data-md-color-accent=indigo aria-label="Switch to light mode" type=radio name=__palette id=__palette_1> <label class="md-header__button md-icon" title="Switch to light mode" for=__palette_0 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M12 18c-.89 0-1.74-.2-2.5-.55C11.56 16.5 13 14.42 13 12s-1.44-4.5-3.5-5.45C10.26 6.2 11.11 6 12 6a6 6 0 0 1 6 6 6 6 0 0 1-6 6m8-9.31V4h-4.69L12 .69 8.69 4H4v4.69L.69 12 4 15.31V20h4.69L12 23.31 15.31 20H20v-4.69L23.31 12z"/></svg> </label> </form> <script>var palette=__md_get("__palette");if(palette&&palette.color){if("(prefers-color-scheme)"===palette.color.media){var media=matchMedia("(prefers-color-scheme: light)"),input=document.querySelector(media.matches?"[data-md-color-media='(prefers-color-scheme: light)']":"[data-md-color-media='(prefers-color-scheme: dark)']");palette.color.media=input.getAttribute("data-md-color-media"),palette.color.scheme=input.getAttribute("data-md-color-scheme"),palette.color.primary=input.getAttribute("data-md-color-primary"),palette.color.accent=input.getAttribute("data-md-color-accent")}for(var[key,value]of Object.entries(palette.color))document.body.setAttribute("data-md-color-"+key,value)}</script> <label class="md-header__button md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> </label> <div class=md-search data-md-componLine truncated
<!doctype html><html lang=en class=no-js> <head><meta charset=utf-8><meta name=viewport content="width=device-width,initial-scale=1"><meta name=author content="Niels Lohmann"><link href="https://json.nlohmann.me/community/assurance_case/" rel="canonical"><link href=../security_policy/ rel=prev><link rel=icon href=../../assets/images/favicon.png><meta name=generator content="mkdocs-1.6.1, mkdocs-material-9.7.7"><title>Assurance case - JSON for Modern C++</title><link rel=stylesheet href=../../assets/stylesheets/main.ec1eaa64.min.css><link rel=stylesheet href=../../assets/stylesheets/palette.ab4e12ef.min.css><link rel="stylesheet" href="../../assets/external/fonts.googleapis.com/css.61a430c9.css"><style>:root{--md-text-font:"Roboto";--md-code-font:"JetBrains Mono"}</style><link rel=stylesheet href=../../css/custom.css><script>__md_scope=new URL("../..",location),__md_hash=e=>[...e].reduce(((e,_)=>(e<<5)-e+_.charCodeAt(0)),0),__md_get=(e,_=localStorage,t=__md_scope)=>JSON.parse(_.getItem(t.pathname+"."+e)),__md_set=(e,_,t=localStorage,a=__md_scope)=>{try{t.setItem(a.pathname+"."+e,JSON.stringify(_))}catch(e){}}</script></head> <body dir=ltr data-md-color-scheme=default data-md-color-primary=indigo data-md-color-accent=indigo> <input class=md-toggle data-md-toggle=drawer type=checkbox id=__drawer autocomplete=off> <input class=md-toggle data-md-toggle=search type=checkbox id=__search autocomplete=off> <label class=md-overlay for=__drawer></label> <div data-md-component=skip> <a href=#assurance-case class=md-skip> Skip to content </a> </div> <div data-md-component=announce> </div> <header class=md-header data-md-component=header> <nav class="md-header__inner md-grid" aria-label=Header> <a href=../.. title="JSON for Modern C++" class="md-header__button md-logo" aria-label="JSON for Modern C++" data-md-component=logo> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M12 8a3 3 0 0 0 3-3 3 3 0 0 0-3-3 3 3 0 0 0-3 3 3 3 0 0 0 3 3m0 3.54C9.64 9.35 6.5 8 3 8v11c3.5 0 6.64 1.35 9 3.54 2.36-2.19 5.5-3.54 9-3.54V8c-3.5 0-6.64 1.35-9 3.54"/></svg> </a> <label class="md-header__button md-icon" for=__drawer> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M3 6h18v2H3zm0 5h18v2H3zm0 5h18v2H3z"/></svg> </label> <div class=md-header__title data-md-component=header-title> <div class=md-header__ellipsis> <div class=md-header__topic> <span class=md-ellipsis> JSON for Modern C++ </span> </div> <div class=md-header__topic data-md-component=header-topic> <span class=md-ellipsis> Assurance case </span> </div> </div> </div> <form class=md-header__option data-md-component=palette> <input class=md-option data-md-color-media="(prefers-color-scheme: light)" data-md-color-scheme=default data-md-color-primary=indigo data-md-color-accent=indigo aria-label="Switch to dark mode" type=radio name=__palette id=__palette_0> <label class="md-header__button md-icon" title="Switch to dark mode" for=__palette_1 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M12 8a4 4 0 0 0-4 4 4 4 0 0 0 4 4 4 4 0 0 0 4-4 4 4 0 0 0-4-4m0 10a6 6 0 0 1-6-6 6 6 0 0 1 6-6 6 6 0 0 1 6 6 6 6 0 0 1-6 6m8-9.31V4h-4.69L12 .69 8.69 4H4v4.69L.69 12 4 15.31V20h4.69L12 23.31 15.31 20H20v-4.69L23.31 12z"/></svg> </label> <input class=md-option data-md-color-media="(prefers-color-scheme: dark)" data-md-color-scheme=slate data-md-color-primary=indigo data-md-color-accent=indigo aria-label="Switch to light mode" type=radio name=__palette id=__palette_1> <label class="md-header__button md-icon" title="Switch to light mode" for=__palette_0 hidden> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M12 18c-.89 0-1.74-.2-2.5-.55C11.56 16.5 13 14.42 13 12s-1.44-4.5-3.5-5.45C10.26 6.2 11.11 6 12 6a6 6 0 0 1 6 6 6 6 0 0 1-6 6m8-9.31V4h-4.69L12 .69 8.69 4H4v4.69L.69 12 4 15.31V20h4.69L12 23.31 15.31 20H20v-4.69L23.31 12z"/></svg> </label> </form> <script>var palette=__md_get("__palette");if(palette&&palette.color){if("(prefers-color-scheme)"===palette.color.media){var media=matchMedia("(prefers-color-scheme: light)"),input=document.querySelector(media.matches?"[data-md-color-media='(prefers-color-scheme: light)']":"[data-md-color-media='(prefers-color-scheme: dark)']");palette.color.media=input.getAttribute("data-md-color-media"),palette.color.scheme=input.getAttribute("data-md-color-scheme"),palette.color.primary=input.getAttribute("data-md-color-primary"),palette.color.accent=input.getAttribute("data-md-color-accent")}for(var[key,value]of Object.entries(palette.color))document.body.setAttribute("data-md-color-"+key,value)}</script> <label class="md-header__button md-icon" for=__search> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg> </label> <div class=md-search data-md-componLine truncated
A[Untrusted input] --&gt; B[Parser]
A --&gt; C[SAX interface]
A --&gt; D[Binary readers]
B --&gt; E["Value tree (basic_json)"]
C --&gt; E
D --&gt; E
E --&gt; F[Trusted caller]</code></pre> <h2 id=secure-design>Secure design<a class=headerlink href=#secure-design title="Permanent link">&para;</a></h2> <ul> <li><strong>Strict parsing.</strong> The parser accepts exactly the <abbr title="JavaScript Object Notation">JSON</abbr> grammar of <a href="https://datatracker.ietf.org/doc/html/rfc8259"><abbr title="Request for Comments">RFC</abbr> 8259</a>. Extensions such as <a href=../../features/comments/ >comments</a> and <a href=../../features/trailing_commas/ >trailing commas</a> must be enabled explicitly. Invalid <abbr title="Unicode Transformation Format">UTF</abbr>-8 is rejected.</li> <li><strong>Errors are reported, not ignored.</strong> Malformed input results in a <a href=../../home/exceptions/#parse-errors><code>parse_error</code></a> with the byte position of the error. Binary readers do not trust announced sizes: strings and binary values grow only as bytes are actually read, arrays reserve at most a fixed number of elements up front, and sizes that no container can hold are rejected.</li> <li><strong>Memory is owned by values.</strong> Each <code>basic_json</code> value owns its content, and there is no manual memory management in user code. The destructor does not recurse, so destroying a deeply nested value does not exhaust the stack.</li> <li><strong>Bounded recursion.</strong> The <abbr title="JavaScript Object Notation">JSON</abbr> parser and the binary readers keep their state in explicit stacks instead of recursing per nesting level. Operations that walk a value, such as <a href=../../api/basic_json/dump/ ><code>dump</code></a>, copying, comparison, hashing, and <a href=../../api/basic_json/merge_patch/ ><code>merge_patch</code></a>, recurse only up to a fixed depth and continue with an explicit stack below it. Some operations, such as <a href=../../api/basic_json/diff/ ><code>diff</code></a>, <a href=../../api/basic_json/flatten/ ><code>flatten</code></a>, and the binary writers, still recurse once per nesting level; work on them is in progress. Applications that process untrusted input can limit its nesting depth with a <a href=../../features/parsing/parser_callbacks/ >parser callback</a>.</li> <li><strong>Invariants are checked.</strong> The class invariant (for instance, that the pointer for the stored type is never null) is checked with runtime assertions throughout the test suite.</li> </ul> <h2 id=common-weaknesses>Common weaknesses<a class=headerlink href=#common-weaknesses title="Permanent link">&para;</a></h2> <p>The following table maps the relevant classes of the <a href="https://cwe.mitre.org">Common Weakness Enumeration</a> to the measures that counter them. The measures are described in detail in <a href=../quality_assurance/ >Quality assurance</a>.</p> <table> <thead> <tr> <th>Weakness</th> <th>Countermeasures</th> </tr> </thead> <tbody> <tr> <td>Out-of-bounds read/write (<a href="https://cwe.mitre.org/data/definitions/125.html">CWE-125</a>, <a href="https://cwe.mitre.org/data/definitions/787.html">CWE-787</a>)</td> <td>bounds checks on all reads from the input; AddressSanitizer and Valgrind on the test suite; OSS-Fuzz</td> </tr> <tr> <td>Integer overflow (<a href="https://cwe.mitre.org/data/definitions/190.html">CWE-190</a>)</td> <td>UndefinedBehaviorSanitizer with integer overflow detection; Clang-Tidy; Cppcheck</td> </tr> <tr> <td>Use after free, double free (<a href="https://cwe.mitre.org/data/definitions/416.html">CWE-416</a>, <a href="https://cwe.mitre.org/data/definitions/415.html">CWE-415</a>)</td> <td>ownership of all memory by values; AddressSanitizer and Valgrind; Clang Static Analyzer</td> </tr> <tr> <td>Memory leaks (<a href="https://cwe.mitre.org/data/definitions/401.html">CWE-401</a>)</td> <td>Valgrind (Memcheck) on the test suite</td> </tr> <tr> <td>Uncontrolled recursion (<a href="https://cwe.mitre.org/data/definitions/674.html">CWE-674</a>)</td> <td>iterative parser, binary readers, and destructor; bounded recursion in value operations; tests with deeply nested inputs</td> </tr> <tr> <td>Uncontrolled resource consumption (<a href="https://cwe.mitre.org/data/definitions/400.html">CWE-400</a>)</td> <td>allocations based on announced sizes are capped; OSS-Fuzz with memory limits</td> </tr> <tr> <td>Undefined behavior in general (<a href="https://cwe.mitre.org/data/definitions/758.html">CWE-758</a>)</td> <td>UndefinedBehaviorSanitizer; runtime assertions; Clang-Tidy, Cppcheck, Clang Static Analyzer, Infer</td> </tr> </tbody> </table> <p>In addition, every line of the library is covered by the unit tests, and all parsers are fuzz-tested around the clock by <a href="https://github.com/google/oss-fuzz/tree/master/projects/json">OSS-Fuzz</a>.</p> <!-- https://squidfunk.github.io/mkdocs-material/reference/tooltips/#adding-a-glossary --> <aside class=md-source-file> <span class=md-source-file__fact> <span class=md-icon title="Last update"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M21 13.1Line truncated
E --&gt; F[Trusted caller]</code></pre> <h2 id=secure-design>Secure design<a class=headerlink href=#secure-design title="Permanent link">&para;</a></h2> <ul> <li><strong>Strict parsing.</strong> The parser accepts exactly the <abbr title="JavaScript Object Notation">JSON</abbr> grammar of <a href="https://datatracker.ietf.org/doc/html/rfc8259"><abbr title="Request for Comments">RFC</abbr> 8259</a>. Extensions such as <a href=../../features/comments/ >comments</a> and <a href=../../features/trailing_commas/ >trailing commas</a> must be enabled explicitly. Invalid <abbr title="Unicode Transformation Format">UTF</abbr>-8 is rejected.</li> <li><strong>Errors are reported, not ignored.</strong> Malformed input results in a <a href=../../home/exceptions/#parse-errors><code>parse_error</code></a> with the byte position of the error. Binary readers do not trust announced sizes: strings and binary values grow only as bytes are actually read, arrays reserve at most a fixed number of elements up front, and sizes that no container can hold are rejected.</li> <li><strong>Memory is owned by values.</strong> Each <code>basic_json</code> value owns its content, and there is no manual memory management in user code. The destructor does not recurse, so destroying a deeply nested value does not exhaust the stack.</li> <li><strong>Bounded recursion.</strong> The <abbr title="JavaScript Object Notation">JSON</abbr> parser and the binary readers keep their state in explicit stacks instead of recursing per nesting level. Operations that walk a value, such as <a href=../../api/basic_json/dump/ ><code>dump</code></a>, copying, comparison, hashing, and <a href=../../api/basic_json/merge_patch/ ><code>merge_patch</code></a>, recurse only up to a fixed depth and continue with an explicit stack below it. Some operations, such as <a href=../../api/basic_json/diff/ ><code>diff</code></a>, <a href=../../api/basic_json/flatten/ ><code>flatten</code></a>, and the binary writers, still recurse once per nesting level; work on them is in progress. Applications that process untrusted input can limit its nesting depth with a <a href=../../features/parsing/parser_callbacks/ >parser callback</a>.</li> <li><strong>Invariants are checked.</strong> The class invariant (for instance, that the pointer for the stored type is never null) is checked with runtime assertions throughout the test suite.</li> </ul> <h2 id=common-weaknesses>Common weaknesses<a class=headerlink href=#common-weaknesses title="Permanent link">&para;</a></h2> <p>The following table maps the relevant classes of the <a href="https://cwe.mitre.org">Common Weakness Enumeration</a> to the measures that counter them. The measures are described in detail in <a href=../quality_assurance/ >Quality assurance</a>.</p> <table> <thead> <tr> <th>Weakness</th> <th>Countermeasures</th> </tr> </thead> <tbody> <tr> <td>Out-of-bounds read/write (<a href="https://cwe.mitre.org/data/definitions/125.html">CWE-125</a>, <a href="https://cwe.mitre.org/data/definitions/787.html">CWE-787</a>)</td> <td>bounds checks on all reads from the input; AddressSanitizer and Valgrind on the test suite; OSS-Fuzz</td> </tr> <tr> <td>Integer overflow (<a href="https://cwe.mitre.org/data/definitions/190.html">CWE-190</a>)</td> <td>UndefinedBehaviorSanitizer with integer overflow detection; Clang-Tidy; Cppcheck</td> </tr> <tr> <td>Use after free, double free (<a href="https://cwe.mitre.org/data/definitions/416.html">CWE-416</a>, <a href="https://cwe.mitre.org/data/definitions/415.html">CWE-415</a>)</td> <td>ownership of all memory by values; AddressSanitizer and Valgrind; Clang Static Analyzer</td> </tr> <tr> <td>Memory leaks (<a href="https://cwe.mitre.org/data/definitions/401.html">CWE-401</a>)</td> <td>Valgrind (Memcheck) on the test suite</td> </tr> <tr> <td>Uncontrolled recursion (<a href="https://cwe.mitre.org/data/definitions/674.html">CWE-674</a>)</td> <td>iterative parser, binary readers, and destructor; bounded recursion in value operations; tests with deeply nested inputs</td> </tr> <tr> <td>Uncontrolled resource consumption (<a href="https://cwe.mitre.org/data/definitions/400.html">CWE-400</a>)</td> <td>allocations based on announced sizes are capped; OSS-Fuzz with memory limits</td> </tr> <tr> <td>Undefined behavior in general (<a href="https://cwe.mitre.org/data/definitions/758.html">CWE-758</a>)</td> <td>UndefinedBehaviorSanitizer; runtime assertions; Clang-Tidy, Cppcheck, Clang Static Analyzer, Infer</td> </tr> </tbody> </table> <p>In addition, every line of the library is covered by the unit tests, and all parsers are fuzz-tested around the clock by <a href="https://github.com/google/oss-fuzz/tree/master/projects/json">OSS-Fuzz</a>.</p> <!-- https://squidfunk.github.io/mkdocs-material/reference/tooltips/#adding-a-glossary --> <aside class=md-source-file> <span class=md-source-file__fact> <span class=md-icon title="Last update"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M21 13.1Line truncated
+1 -1
View File
@@ -6,7 +6,7 @@ This page argues why the library meets its security requirements. It describes t
The library parses, stores, and serializes JSON values in memory. It does not open network connections, does not open files (it only reads from streams or `std::FILE*` handles that the caller has already opened), does not read environment variables, and does not implement cryptography or handle credentials.
The primary threat is therefore **untrusted input**: JSON text or binary data (BJData, BSON, CBOR, MessagePack, UBJSON) that an attacker controls, passed to [`parse`](https://json.nlohmann.me/api/basic_json/parse/index.md), [`accept`](https://json.nlohmann.me/api/basic_json/accept/index.md), [`sax_parse`](https://json.nlohmann.me/api/basic_json/sax_parse/index.md), or one of the `from_*` functions such as [`from_cbor`](https://json.nlohmann.me/api/basic_json/from_cbor/index.md). Such input may try to
The primary threat is therefore **untrusted input**: JSON text or binary data (BJData, BON8, BSON, CBOR, MessagePack, UBJSON) that an attacker controls, passed to [`parse`](https://json.nlohmann.me/api/basic_json/parse/index.md), [`accept`](https://json.nlohmann.me/api/basic_json/accept/index.md), [`sax_parse`](https://json.nlohmann.me/api/basic_json/sax_parse/index.md), or one of the `from_*` functions such as [`from_cbor`](https://json.nlohmann.me/api/basic_json/from_cbor/index.md). Such input may try to
- make the library read or write out of bounds (malformed lengths, truncated input, invalid UTF-8),
- trigger undefined behavior (integer overflow in sizes or numbers, invalid casts),