deploy: 4e294f4b18

community/assurance_case.md

@@ -54,10 +54,9 @@ flowchart LR
   user code. The destructor does not recurse, so destroying a deeply nested value does not exhaust the stack.
 - **Bounded recursion.** The JSON parser and the binary readers keep their state in explicit stacks instead of
   recursing per nesting level. Operations that walk a value, such as [`dump`](../api/basic_json/dump.md), copying,
-  comparison, hashing, and [`merge_patch`](../api/basic_json/merge_patch.md), recurse only up to a fixed depth and
-  continue with an explicit stack below it. Some operations, such as [`diff`](../api/basic_json/diff.md),
-  [`flatten`](../api/basic_json/flatten.md), and the binary writers, still recurse once per nesting level; work on them
-  is in progress. Applications that process untrusted input can limit its nesting depth with a
+  comparison, hashing, [`merge_patch`](../api/basic_json/merge_patch.md), [`diff`](../api/basic_json/diff.md),
+  [`flatten`](../api/basic_json/flatten.md), and the binary writers, recurse only up to a fixed depth and continue with
+  an explicit stack below it. Applications that process untrusted input can limit its nesting depth with a
   [parser callback](../features/parsing/parser_callbacks.md).
 - **Invariants are checked.** The class invariant (for instance, that the pointer for the stored type is never null) is
   checked with runtime assertions throughout the test suite.

community/assurance_case/index.html

@@ -5,4 +5,4 @@
     B --> E["Value tree (basic_json)"]
     C --> E
     D --> E
-    E --&gt; F[Trusted caller]</code></pre> <h2 id=secure-design>Secure design<a class=headerlink href=#secure-design title="Permanent link">&para;</a></h2> <ul> <li><strong>Strict parsing.</strong> The parser accepts exactly the <abbr title="JavaScript Object Notation">JSON</abbr> grammar of <a href="https://datatracker.ietf.org/doc/html/rfc8259"><abbr title="Request for Comments">RFC</abbr> 8259</a>. Extensions such as <a href=../../features/comments/ >comments</a> and <a href=../../features/trailing_commas/ >trailing commas</a> must be enabled explicitly. Invalid <abbr title="Unicode Transformation Format">UTF</abbr>-8 is rejected.</li> <li><strong>Errors are reported, not ignored.</strong> Malformed input results in a <a href=../../home/exceptions/#parse-errors><code>parse_error</code></a> with the byte position of the error. Binary readers do not trust announced sizes: strings and binary values grow only as bytes are actually read, arrays reserve at most a fixed number of elements up front, and sizes that no container can hold are rejected.</li> <li><strong>Memory is owned by values.</strong> Each <code>basic_json</code> value owns its content, and there is no manual memory management in user code. The destructor does not recurse, so destroying a deeply nested value does not exhaust the stack.</li> <li><strong>Bounded recursion.</strong> The <abbr title="JavaScript Object Notation">JSON</abbr> parser and the binary readers keep their state in explicit stacks instead of recursing per nesting level. Operations that walk a value, such as <a href=../../api/basic_json/dump/ ><code>dump</code></a>, copying, comparison, hashing, and <a href=../../api/basic_json/merge_patch/ ><code>merge_patch</code></a>, recurse only up to a fixed depth and continue with an explicit stack below it. Some operations, such as <a href=../../api/basic_json/diff/ ><code>diff</code></a>, <a href=../../api/basic_json/flatten/ ><code>flatten</code></a>, and the binary writers, still recurse once per nesting level; work on them is in progress. Applications that process untrusted input can limit its nesting depth with a <a href=../../features/parsing/parser_callbacks/ >parser callback</a>.</li> <li><strong>Invariants are checked.</strong> The class invariant (for instance, that the pointer for the stored type is never null) is checked with runtime assertions throughout the test suite.</li> </ul> <h2 id=common-weaknesses>Common weaknesses<a class=headerlink href=#common-weaknesses title="Permanent link">&para;</a></h2> <p>The following table maps the relevant classes of the <a href="https://cwe.mitre.org">Common Weakness Enumeration</a> to the measures that counter them. The measures are described in detail in <a href=../quality_assurance/ >Quality assurance</a>.</p> <table> <thead> <tr> <th>Weakness</th> <th>Countermeasures</th> </tr> </thead> <tbody> <tr> <td>Out-of-bounds read/write (<a href="https://cwe.mitre.org/data/definitions/125.html">CWE-125</a>, <a href="https://cwe.mitre.org/data/definitions/787.html">CWE-787</a>)</td> <td>bounds checks on all reads from the input; AddressSanitizer and Valgrind on the test suite; OSS-Fuzz</td> </tr> <tr> <td>Integer overflow (<a href="https://cwe.mitre.org/data/definitions/190.html">CWE-190</a>)</td> <td>UndefinedBehaviorSanitizer with integer overflow detection; Clang-Tidy; Cppcheck</td> </tr> <tr> <td>Use after free, double free (<a href="https://cwe.mitre.org/data/definitions/416.html">CWE-416</a>, <a href="https://cwe.mitre.org/data/definitions/415.html">CWE-415</a>)</td> <td>ownership of all memory by values; AddressSanitizer and Valgrind; Clang Static Analyzer</td> </tr> <tr> <td>Memory leaks (<a href="https://cwe.mitre.org/data/definitions/401.html">CWE-401</a>)</td> <td>Valgrind (Memcheck) on the test suite</td> </tr> <tr> <td>Uncontrolled recursion (<a href="https://cwe.mitre.org/data/definitions/674.html">CWE-674</a>)</td> <td>iterative parser, binary readers, and destructor; bounded recursion in value operations; tests with deeply nested inputs</td> </tr> <tr> <td>Uncontrolled resource consumption (<a href="https://cwe.mitre.org/data/definitions/400.html">CWE-400</a>)</td> <td>allocations based on announced sizes are capped; OSS-Fuzz with memory limits</td> </tr> <tr> <td>Undefined behavior in general (<a href="https://cwe.mitre.org/data/definitions/758.html">CWE-758</a>)</td> <td>UndefinedBehaviorSanitizer; runtime assertions; Clang-Tidy, Cppcheck, Clang Static Analyzer, Infer</td> </tr> </tbody> </table> <p>In addition, every line of the library is covered by the unit tests, and all parsers are fuzz-tested around the clock by <a href="https://github.com/google/oss-fuzz/tree/master/projects/json">OSS-Fuzz</a>.</p> <!-- https://squidfunk.github.io/mkdocs-material/reference/tooltips/#adding-a-glossary --> <aside class=md-source-file> <span class=md-source-file__fact> <span class=md-icon title="Last update"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M21 13.1Line truncated
+    E --&gt; F[Trusted caller]</code></pre> <h2 id=secure-design>Secure design<a class=headerlink href=#secure-design title="Permanent link">&para;</a></h2> <ul> <li><strong>Strict parsing.</strong> The parser accepts exactly the <abbr title="JavaScript Object Notation">JSON</abbr> grammar of <a href="https://datatracker.ietf.org/doc/html/rfc8259"><abbr title="Request for Comments">RFC</abbr> 8259</a>. Extensions such as <a href=../../features/comments/ >comments</a> and <a href=../../features/trailing_commas/ >trailing commas</a> must be enabled explicitly. Invalid <abbr title="Unicode Transformation Format">UTF</abbr>-8 is rejected.</li> <li><strong>Errors are reported, not ignored.</strong> Malformed input results in a <a href=../../home/exceptions/#parse-errors><code>parse_error</code></a> with the byte position of the error. Binary readers do not trust announced sizes: strings and binary values grow only as bytes are actually read, arrays reserve at most a fixed number of elements up front, and sizes that no container can hold are rejected.</li> <li><strong>Memory is owned by values.</strong> Each <code>basic_json</code> value owns its content, and there is no manual memory management in user code. The destructor does not recurse, so destroying a deeply nested value does not exhaust the stack.</li> <li><strong>Bounded recursion.</strong> The <abbr title="JavaScript Object Notation">JSON</abbr> parser and the binary readers keep their state in explicit stacks instead of recursing per nesting level. Operations that walk a value, such as <a href=../../api/basic_json/dump/ ><code>dump</code></a>, copying, comparison, hashing, <a href=../../api/basic_json/merge_patch/ ><code>merge_patch</code></a>, <a href=../../api/basic_json/diff/ ><code>diff</code></a>, <a href=../../api/basic_json/flatten/ ><code>flatten</code></a>, and the binary writers, recurse only up to a fixed depth and continue with an explicit stack below it. Applications that process untrusted input can limit its nesting depth with a <a href=../../features/parsing/parser_callbacks/ >parser callback</a>.</li> <li><strong>Invariants are checked.</strong> The class invariant (for instance, that the pointer for the stored type is never null) is checked with runtime assertions throughout the test suite.</li> </ul> <h2 id=common-weaknesses>Common weaknesses<a class=headerlink href=#common-weaknesses title="Permanent link">&para;</a></h2> <p>The following table maps the relevant classes of the <a href="https://cwe.mitre.org">Common Weakness Enumeration</a> to the measures that counter them. The measures are described in detail in <a href=../quality_assurance/ >Quality assurance</a>.</p> <table> <thead> <tr> <th>Weakness</th> <th>Countermeasures</th> </tr> </thead> <tbody> <tr> <td>Out-of-bounds read/write (<a href="https://cwe.mitre.org/data/definitions/125.html">CWE-125</a>, <a href="https://cwe.mitre.org/data/definitions/787.html">CWE-787</a>)</td> <td>bounds checks on all reads from the input; AddressSanitizer and Valgrind on the test suite; OSS-Fuzz</td> </tr> <tr> <td>Integer overflow (<a href="https://cwe.mitre.org/data/definitions/190.html">CWE-190</a>)</td> <td>UndefinedBehaviorSanitizer with integer overflow detection; Clang-Tidy; Cppcheck</td> </tr> <tr> <td>Use after free, double free (<a href="https://cwe.mitre.org/data/definitions/416.html">CWE-416</a>, <a href="https://cwe.mitre.org/data/definitions/415.html">CWE-415</a>)</td> <td>ownership of all memory by values; AddressSanitizer and Valgrind; Clang Static Analyzer</td> </tr> <tr> <td>Memory leaks (<a href="https://cwe.mitre.org/data/definitions/401.html">CWE-401</a>)</td> <td>Valgrind (Memcheck) on the test suite</td> </tr> <tr> <td>Uncontrolled recursion (<a href="https://cwe.mitre.org/data/definitions/674.html">CWE-674</a>)</td> <td>iterative parser, binary readers, and destructor; bounded recursion in value operations; tests with deeply nested inputs</td> </tr> <tr> <td>Uncontrolled resource consumption (<a href="https://cwe.mitre.org/data/definitions/400.html">CWE-400</a>)</td> <td>allocations based on announced sizes are capped; OSS-Fuzz with memory limits</td> </tr> <tr> <td>Undefined behavior in general (<a href="https://cwe.mitre.org/data/definitions/758.html">CWE-758</a>)</td> <td>UndefinedBehaviorSanitizer; runtime assertions; Clang-Tidy, Cppcheck, Clang Static Analyzer, Infer</td> </tr> </tbody> </table> <p>In addition, every line of the library is covered by the unit tests, and all parsers are fuzz-tested around the clock by <a href="https://github.com/google/oss-fuzz/tree/master/projects/json">OSS-Fuzz</a>.</p> <!-- https://squidfunk.github.io/mkdocs-material/reference/tooltips/#adding-a-glossary --> <aside class=md-source-file> <span class=md-source-file__fact> <span class=md-icon title="Last update"> <svg xmlns=http://www.w3.org/2000/svg viewbox="0 0 24 24"><path d="M21 13.1c-.1 0-.3.1-.4.2l-1 1 2.1 2.1 1-1c.2-.2.2-.6 0-.8l-1.3-1.3c-.1-.1-.2-.2-.4-.2m-1.9 1.8-6.1 6V23hLine truncated

community/assurance_case/index.md

@@ -34,7 +34,7 @@ flowchart LR
 - **Strict parsing.** The parser accepts exactly the JSON grammar of [RFC 8259](https://datatracker.ietf.org/doc/html/rfc8259). Extensions such as [comments](https://json.nlohmann.me/features/comments/index.md) and [trailing commas](https://json.nlohmann.me/features/trailing_commas/index.md) must be enabled explicitly. Invalid UTF-8 is rejected.
 - **Errors are reported, not ignored.** Malformed input results in a [`parse_error`](https://json.nlohmann.me/home/exceptions/#parse-errors) with the byte position of the error. Binary readers do not trust announced sizes: strings and binary values grow only as bytes are actually read, arrays reserve at most a fixed number of elements up front, and sizes that no container can hold are rejected.
 - **Memory is owned by values.** Each `basic_json` value owns its content, and there is no manual memory management in user code. The destructor does not recurse, so destroying a deeply nested value does not exhaust the stack.
-- **Bounded recursion.** The JSON parser and the binary readers keep their state in explicit stacks instead of recursing per nesting level. Operations that walk a value, such as [`dump`](https://json.nlohmann.me/api/basic_json/dump/index.md), copying, comparison, hashing, and [`merge_patch`](https://json.nlohmann.me/api/basic_json/merge_patch/index.md), recurse only up to a fixed depth and continue with an explicit stack below it. Some operations, such as [`diff`](https://json.nlohmann.me/api/basic_json/diff/index.md), [`flatten`](https://json.nlohmann.me/api/basic_json/flatten/index.md), and the binary writers, still recurse once per nesting level; work on them is in progress. Applications that process untrusted input can limit its nesting depth with a [parser callback](https://json.nlohmann.me/features/parsing/parser_callbacks/index.md).
+- **Bounded recursion.** The JSON parser and the binary readers keep their state in explicit stacks instead of recursing per nesting level. Operations that walk a value, such as [`dump`](https://json.nlohmann.me/api/basic_json/dump/index.md), copying, comparison, hashing, [`merge_patch`](https://json.nlohmann.me/api/basic_json/merge_patch/index.md), [`diff`](https://json.nlohmann.me/api/basic_json/diff/index.md), [`flatten`](https://json.nlohmann.me/api/basic_json/flatten/index.md), and the binary writers, recurse only up to a fixed depth and continue with an explicit stack below it. Applications that process untrusted input can limit its nesting depth with a [parser callback](https://json.nlohmann.me/features/parsing/parser_callbacks/index.md).
 - **Invariants are checked.** The class invariant (for instance, that the pointer for the stored type is never null) is checked with runtime assertions throughout the test suite.
 
 ## Common weaknesses