Merge develop

Signed-off-by: Niels Lohmann <mail@nlohmann.me>

docs/mkdocs/docs/api/basic_json/at.md

@@ -90,7 +90,8 @@ Strong exception safety: if an exception occurs, the original value stays intact
 1. Constant.
 2. Logarithmic in the size of the container.
 3. Logarithmic in the size of the container.
-4. Logarithmic in the size of the container.
+4. Linear in the number of reference tokens of `ptr`; for each of them, logarithmic in the size of the object, or
+   constant for an array.
 
 ## Notes
 

docs/mkdocs/docs/api/basic_json/diff.md

@@ -19,9 +19,10 @@ The equality holds up to [`operator==`](operator_eq.md), so it has the following
 - A value that is not equal to itself cannot round-trip. This applies to `NaN` (also nested in an array or object) and
   to [discarded](is_discarded.md) values: `diff` emits a `replace` operation for them. A `NaN` in the patch is
   serialized as `#!json null`, so a patch that was dumped and parsed again would set `#!json null`.
-- Numbers that compare equal produce no operation, even if their types or signs differ: `diff(1, 1.0)`,
-  `diff(1u, 1)` (unsigned and signed integer) and `diff(0.0, -0.0)` all return `#!json []`. The patched value is then
-  the `source` and keeps its number type.
+- Numbers that compare equal produce no operation, even if their types differ or if one is zero and the other is
+  negative zero: `diff(1, 1.0)` (integer and floating-point), `diff(1u, 1)` (unsigned and signed integer) and
+  `diff(0.0, -0.0)` (positive and negative zero) all return `#!json []`. The patched value is then the `source` and
+  keeps its number type and sign.
 
 ## Parameters
 

docs/mkdocs/docs/api/basic_json/operator[].md

@@ -92,12 +92,20 @@ Strong exception safety: if an exception occurs, the original value stays intact
     For the **const** version, an object key or array index in `ptr` that does not exist is not reported by an
     exception, but is undefined behavior (see the notes below). Use [`at`](at.md) for checked access.
 
+    If the **non-const** version throws, the value is left unchanged: values it created for earlier reference tokens
+    of `ptr` are removed again. This also holds for exceptions such as `#!cpp std::bad_alloc` or
+    `#!cpp std::length_error` thrown while padding an array up to a very large index. With custom
+    [template parameters](../../features/types/template_parameters.md), this requires that `erase()` of the object and
+    array types and the move operations of the custom base class do not throw.
+
 ## Complexity
 
 1. Constant if `idx` is in the range of the array. Otherwise, linear in `idx - size()`.
 2. Logarithmic in the size of the container.
 3. Logarithmic in the size of the container.
-4. Logarithmic in the size of the container.
+4. Linear in the number of reference tokens of `ptr`; for each of them, logarithmic in the size of the object, or
+   constant for an array. When the non-const version pads an array with `#!json null` values, it is additionally
+   linear in `idx - size()` for that array.
 
 ## Notes
 
@@ -145,6 +153,14 @@ Strong exception safety: if an exception occurs, the original value stays intact
         specified by the JSON Pointer RFC; it is this library's own, intentional disambiguation rule. See also
         [JSON Pointer](../../features/json_pointer.md).
 
+    !!! warning "Large array indices"
+
+        As the array is filled up with `#!json null` values to the given index, the memory used grows with the index
+        and not with the size of the pointer: on a 64-bit platform, the index `10000000` allocates about 160 MB.
+        The library does not limit the index, so check the array indices of a JSON pointer from untrusted input
+        before using it with the non-const version. See
+        [Parsing untrusted input](../../features/parsing/untrusted_input.md#json-pointers-and-flattened-keys).
+
 !!! warning "Deprecation"
 
     Overload (4) also accepts a [`json_pointer`](../json_pointer/index.md) whose template argument is a `basic_json`
@@ -296,4 +312,6 @@ Strong exception safety: if an exception occurs, the original value stays intact
 4. Added in version 2.0.0. A missing array index in the const version is guarded by a runtime assertion since
    version 3.13.0. Throws [`parse_error.109`](../../home/exceptions.md#jsonexceptionparse_error109) instead of
 [`out_of_range.404`](../../home/exceptions.md#jsonexceptionout_of_range404) for a one-character array index that is not
-a digit (e.g., `/x`) in version 3.13.0, as it already did for longer ones.
+a digit (e.g., `/x`) in version 3.13.0, as it already did for longer ones. Fixed in version 3.13.0 to leave the value
+unchanged if the non-const version throws (strong exception safety, as documented); before, values created for earlier
+reference tokens of `ptr` were kept.

docs/mkdocs/docs/features/json_patch.md

@@ -78,8 +78,9 @@ flowchart LR
     - `NaN` and [discarded](../api/basic_json/is_discarded.md) values are not equal to themselves, so the invariant
       cannot hold for them. `diff` emits a `replace` operation for such a value, and a `NaN` in a patch is serialized
       as `#!json null`.
-    - Numbers that compare equal produce no operation even if their types differ: `diff(1, 1.0)`, `diff(1u, 1)`, and
-      `diff(0.0, -0.0)` return `#!json []`, so the patched value keeps the number type of *source*.
+    - Numbers that compare equal produce no operation even if their types differ or if one is zero and the other is
+      negative zero: `diff(1, 1.0)`, `diff(1u, 1)`, and `diff(0.0, -0.0)` return `#!json []`, so the patched value
+      keeps the number type and sign of *source*.
     - A [binary value](binary_values.md) in a patch is serialized as an object
       (`#!json {"bytes":[...],"subtype":null}`), so a patch that was dumped and parsed again no longer holds a binary
       value.

docs/mkdocs/docs/features/parsing/untrusted_input.md

@@ -130,6 +130,17 @@ parameters of [`parse()`](../../api/basic_json/parse.md) or [`accept()`](../../a
 enable either for input whose conformance you cannot otherwise control, since interoperability with strictly
 conforming JSON consumers is exactly what the default rejects.
 
+## JSON Pointers and flattened keys
+
+A [JSON Pointer](../json_pointer.md) can come from untrusted input as well, for instance as a path in a request or as a
+key of a flattened object. The non-const [`operator[]`](../../api/basic_json/operator%5B%5D.md) with a JSON Pointer and
+[`unflatten`](../../api/basic_json/unflatten.md) create missing values, and when an array index lies beyond the end of
+an array, they fill the array with `#!json null` values up to that index. The memory used therefore grows with the
+index, not with the size of the pointer: on a 64-bit platform, the index `10000000` allocates about 160 MB, the index
+`100000000` about 1.6 GB. The library does not limit the index. For pointers from untrusted input, check the array
+indices (or the pointer as a whole) before using them, or use [`at`](../../api/basic_json/at.md) or
+[`contains`](../../api/basic_json/contains.md), which never add values.
+
 ## Checklist
 
 - Wrap parsing in a `#!cpp try`/`#!cpp catch` block, or use `allow_exceptions=false`/`accept()` if your environment
@@ -145,6 +156,8 @@ conforming JSON consumers is exactly what the default rejects.
   `JSON_STRICT_NUL_HANDLING`.
 - Decide whether duplicate object keys should be an error for your application, and add a callback if so.
 - Do not enable `ignore_comments` or `ignore_trailing_commas` for input that must be strictly conforming JSON.
+- Check the array indices of untrusted JSON Pointers and flattened keys before passing them to the non-const
+  `operator[]` or `unflatten()`, which fill arrays with `#!json null` values up to the index.
 
 For the broader design rationale and how it is tested (fuzzing, sanitizers, static analysis), see the
 [assurance case](../../community/assurance_case.md) and [quality assurance](../../community/quality_assurance.md). To