Fix parse(container, function) for plain functions as callback

Passing a plain function or function pointer as parser callback, as in json::parse(std::string("[1,2]"), cb), stopped compiling in C++11/14/17. The iterator+sentinel overloads added for C++20 ranges are constrained by can_compare_ne, i.e. whether `first != last` is well-formed. The callback's parameter types make basic_json an associated class, so ADL finds the friend operator!=(const_reference, ScalarType): the container converts to basic_json and the function pointer is a scalar. The sentinel overload was thereby selected and failed hard in its body.

can_compare_ne now excludes function pointers and functions as sentinel type, since a callback is never a sentinel. This shared constraint guards parse, accept, sax_parse and all from_* overloads. Checking IteratorType via std::iterator_traits was avoided on purpose: it would instantiate iterator_traits for every two-argument call, which is a hard error on standard libraries with a non-SFINAE-friendly iterator_traits.

Signed-off-by: Niels Lohmann <mail@nlohmann.me>

.github/dependabot.yml

@@ -67,4 +67,3 @@ updates:
       - dependency-name: mcp
       - dependency-name: boltons
       - dependency-name: "opentelemetry-*"
-      - dependency-name: importlib-metadata

cmake/requirements/requirements-semgrep.txt

@@ -391,9 +391,9 @@ httpx-sse==0.4.3 \
 idna==3.20 \
     --hash=sha256:a7db850025b95ded1eae8a46181a1a6c56c92c96f0e2b005d9ff8dc0210cab44 \
     --hash=sha256:ab7ae7122974553370f0bdb919e1a960b2cd1bc1ef0276416d896db81c14582c
-importlib-metadata==8.7.1 \
+importlib-metadata==10.1.0 \
-    --hash=sha256:49fef1ae6440c182052f407c8d34a68f72efc36db9ca90dc0113398f2fdde8bb \
+    --hash=sha256:82b04047fa09792c1a8cfeddfe08bec79e4b13c29c8469b0d3949860f61017e8 \
-    --hash=sha256:5a1f80bf1daa489495071efbb095d75a634cf28a8bc299581244063b53176151
+    --hash=sha256:cf45ce66a929c64e994185a809c04840d0501db17e663810d993d0f4829265c7
 jsonschema==4.25.1 \
     --hash=sha256:3fba0169e345c7175110351d456342c364814cfcf3b964ba4587f22915230a63 \
     --hash=sha256:e4a9655ce0da0c0b67a085847e00a3a51449e1157f4f75e9fb5aa545e122eb85
@@ -442,9 +442,9 @@ opentelemetry-util-http==0.58b0 \
 packaging==26.3 \
     --hash=sha256:94edc256424af38762eb31306eed28beb9f0efc50a8837492c9d6fd6004aed79 \
     --hash=sha256:d7193f7c8e4e93f444fde0262bf90af30e16fa0ad0ad44cb553c87339b23cd1c
-peewee==4.5.3 \
+peewee==3.19.0 \
-    --hash=sha256:434576afaf806428a01f84af74c42fde59372c4f6a6eba26d9b5372113344a8a \
+    --hash=sha256:de220b94766e6008c466e00ce4ba5299b9a832117d9eb36d45d0062f3cfd7417 \
-    --hash=sha256:4c5db9d2a3c4ae9a5725b229c29af51dbd063193f3a6c03b837974a90e44548c
+    --hash=sha256:f88292a6f0d7b906cb26bca9c8599b8f4d8920ebd36124400d0cbaaaf915511f
 protobuf==6.33.6 \
     --hash=sha256:0cd27b587afca21b7cfa59a74dcbd48a50f0a6400cfb59391340ad729d91d326 \
     --hash=sha256:77179e006c476e69bf8e8ce866640091ec42e1beb80b213c3900006ecfba6901 \

include/nlohmann/detail/input/input_adapters.hpp

@@ -1312,15 +1312,23 @@ struct can_compare_ne_either_order : std::integral_constant < bool,
     can_compare_ne_impl<IteratorType, SentinelType>::value ||
     can_compare_ne_reversed<IteratorType, SentinelType>::value > {};
 
-// std::nullptr_t is excluded explicitly: a literal `nullptr` passed as a
+// Two kinds of SentinelType are excluded explicitly:
-// trailing default argument (e.g. parse(s, nullptr, ...)) must never be
+//
-// mistaken for a sentinel, and some compilers (e.g. GCC 4.8) unreliably
+// - std::nullptr_t: a literal `nullptr` passed as a trailing default argument
-// SFINAE the `operator!=` detection above for std::nullptr_t against
+//   (e.g. parse(s, nullptr, ...)) must never be mistaken for a sentinel, and
-// container/string types, which would otherwise make such calls ambiguous
+//   some compilers (e.g. GCC 4.8) unreliably SFINAE the `operator!=` detection
-// with the compatible-input overload.
+//   above for std::nullptr_t against container/string types, which would
+//   otherwise make such calls ambiguous with the compatible-input overload.
+// - function pointers and functions: a parser callback passed as plain function
+//   (e.g. parse(s, cb)) is never a sentinel. The callback's parameter types
+//   make basic_json an associated class, so ADL finds the friend
+//   operator!=(const_reference, ScalarType) of basic_json, which makes
+//   `s != cb` well-formed (both convert to basic_json) and would select the
+//   iterator/sentinel overload.
 template<typename IteratorType, typename SentinelType>
 struct can_compare_ne : std::integral_constant < bool,
     !std::is_same<SentinelType, std::nullptr_t>::value &&
+    !std::is_function<typename std::remove_pointer<SentinelType>::type>::value &&
     can_compare_ne_either_order<IteratorType, SentinelType>::value > {};
 
 template<typename T>

single_include/nlohmann/json.hpp

@@ -10421,15 +10421,23 @@ struct can_compare_ne_either_order : std::integral_constant < bool,
     can_compare_ne_impl<IteratorType, SentinelType>::value ||
     can_compare_ne_reversed<IteratorType, SentinelType>::value > {};
 
-// std::nullptr_t is excluded explicitly: a literal `nullptr` passed as a
+// Two kinds of SentinelType are excluded explicitly:
-// trailing default argument (e.g. parse(s, nullptr, ...)) must never be
+//
-// mistaken for a sentinel, and some compilers (e.g. GCC 4.8) unreliably
+// - std::nullptr_t: a literal `nullptr` passed as a trailing default argument
-// SFINAE the `operator!=` detection above for std::nullptr_t against
+//   (e.g. parse(s, nullptr, ...)) must never be mistaken for a sentinel, and
-// container/string types, which would otherwise make such calls ambiguous
+//   some compilers (e.g. GCC 4.8) unreliably SFINAE the `operator!=` detection
-// with the compatible-input overload.
+//   above for std::nullptr_t against container/string types, which would
+//   otherwise make such calls ambiguous with the compatible-input overload.
+// - function pointers and functions: a parser callback passed as plain function
+//   (e.g. parse(s, cb)) is never a sentinel. The callback's parameter types
+//   make basic_json an associated class, so ADL finds the friend
+//   operator!=(const_reference, ScalarType) of basic_json, which makes
+//   `s != cb` well-formed (both convert to basic_json) and would select the
+//   iterator/sentinel overload.
 template<typename IteratorType, typename SentinelType>
 struct can_compare_ne : std::integral_constant < bool,
     !std::is_same<SentinelType, std::nullptr_t>::value &&
+    !std::is_function<typename std::remove_pointer<SentinelType>::type>::value &&
     can_compare_ne_either_order<IteratorType, SentinelType>::value > {};
 
 template<typename T>

tests/src/unit-class_parser.cpp

@@ -3232,3 +3232,40 @@ TEST_CASE("object keys are delivered decoded and validated")
         CHECK(keys_of_format(std::string("\x87\xC3\x28\x91"), json::input_format_t::bon8).empty());
     }
 }
+
+namespace
+{
+// a plain function (not a lambda or std::function) used as parser callback
+bool keep_everything_callback(int /*depth*/, json::parse_event_t /*event*/, json& /*parsed*/)
+{
+    return true;
+}
+} // namespace
+
+TEST_CASE("a plain function is accepted as parser callback for containers")
+{
+    // ADL finds basic_json's friend operator!= for "container != function
+    // pointer", which must not make the iterator/sentinel overloads viable
+
+    const json expected = {1, 2};
+    const std::string text = "[1,2]";
+    const std::vector<std::uint8_t> bytes(text.begin(), text.end());
+    const std::vector<char> chars(text.begin(), text.end());
+
+    CHECK(json::parse(text, keep_everything_callback) == expected);
+    CHECK(json::parse(text, &keep_everything_callback) == expected);
+    CHECK(json::parse(std::string("[1,2]"), keep_everything_callback) == expected);
+    CHECK(json::parse(bytes, keep_everything_callback) == expected);
+    CHECK(json::parse(bytes, &keep_everything_callback) == expected);
+    CHECK(json::parse(chars, keep_everything_callback) == expected);
+    CHECK(json::parse(text.begin(), text.end(), keep_everything_callback) == expected);
+
+    // the sentinel overloads (shared constraint of parse, accept, sax_parse and
+    // the from_* functions) are not viable for a container and a function
+    // pointer, but still are for iterator pairs
+    using callback_pointer = decltype(&keep_everything_callback);
+    CHECK_FALSE((nlohmann::detail::can_compare_ne<std::string, callback_pointer>::value));
+    CHECK_FALSE((nlohmann::detail::can_compare_ne<std::vector<std::uint8_t>, callback_pointer>::value));
+    CHECK((nlohmann::detail::can_compare_ne<std::string::const_iterator, std::string::const_iterator>::value));
+    CHECK((nlohmann::detail::can_compare_ne<const char*, const char*>::value));
+}