Check the iterator range for binary values in basic_json(first, last)

basic_json(first, last) treated value_t::binary like the structured
types (array, object) in the range check, so it always copied the
whole binary value regardless of the iterators, even for an empty
range such as (b.end(), b.end()). The other primitive types (number,
boolean, string) already reject such a range with
invalid_iterator.204, and erase(first, last) already does the same
for binary values, so this made the constructor inconsistent with
both. Move case value_t::binary into the group of checked primitive
types.

Also update the two matching passages in basic_json.md that describe
overload 7, and add a version-history note.

Fixes #5670.

Signed-off-by: Niels Lohmann <mail@nlohmann.me>

docs/mkdocs/docs/api/basic_json/basic_json.md

@@ -139,8 +139,8 @@ basic_json(basic_json&& other) noexcept;
 
     - In case of a `#!json null` type, [invalid_iterator.206](../../home/exceptions.md#jsonexceptioninvalid_iterator206)
       is thrown.
-    - In case of other primitive types (number, boolean, or string), `first` must be `begin()` and `last` must be
-      `end()`. In this case, the value is copied. Otherwise,
+    - In case of other primitive types (number, boolean, string, or binary), `first` must be `begin()` and `last`
+      must be `end()`. In this case, the value is copied. Otherwise,
       [`invalid_iterator.204`](../../home/exceptions.md#jsonexceptioninvalid_iterator204) is thrown.
     - In case of structured types (array, object), the constructor behaves as similar versions for `std::vector` or
       `std::map`; that is, a JSON array or object is constructed from the values in the range.
@@ -242,8 +242,8 @@ basic_json(basic_json&& other) noexcept;
       and `last` are not compatible (i.e., do not belong to the same JSON value). In this case, the range
       `[first, last)` is undefined.
     - Throws [`invalid_iterator.204`](../../home/exceptions.md#jsonexceptioninvalid_iterator204) if iterators `first`
-      and `last` belong to a primitive type (number, boolean, or string), but `first` does not point to the first
-      element anymore. In this case, the range `[first, last)` is undefined. See the example code below.
+      and `last` belong to a primitive type (number, boolean, string, or binary), but `first` does not point to the
+      first element anymore. In this case, the range `[first, last)` is undefined. See the example code below.
     - Throws [`invalid_iterator.206`](../../home/exceptions.md#jsonexceptioninvalid_iterator206) if iterators `first`
       and `last` belong to a `#!json null` value. In this case, the range `[first, last)` is undefined.
 8. (none)
@@ -423,6 +423,8 @@ basic_json(basic_json&& other) noexcept;
 4. Since version 3.2.0.
 5. Since version 1.0.0.
 6. Since version 1.0.0.
-7. Since version 1.0.0.
+7. Since version 1.0.0. Fixed in version 3.13.0 to also check the iterator range for binary values; before, a range
+   that did not cover the whole value (such as `(end(), end())`) was accepted and the whole binary value was copied,
+   unlike the other primitive types.
 8. Since version 1.0.0.
 9. Since version 1.0.0.

include/nlohmann/detail/json_pointer.hpp

@@ -746,12 +746,6 @@ class json_pointer
                         // "-" always fails the range check
                         return false;
                     }
-                    if (JSON_HEDLEY_UNLIKELY(reference_token.empty()))
-                    {
-                        // an empty reference token is not an array index; array_index()
-                        // would throw out_of_range.404 -- contains() must not throw (see #5395)
-                        return false;
-                    }
                     if (JSON_HEDLEY_UNLIKELY(reference_token.size() == 1 && !("0" <= reference_token && reference_token <= "9")))
                     {
                         // invalid char

include/nlohmann/json.hpp

@@ -1829,6 +1829,7 @@ class basic_json // NOLINT(cppcoreguidelines-special-member-functions,hicpp-spec
             case value_t::number_integer:
             case value_t::number_unsigned:
             case value_t::string:
+            case value_t::binary:
             {
                 if (JSON_HEDLEY_UNLIKELY(!first.m_it.primitive_iterator.is_begin()
                                          || !last.m_it.primitive_iterator.is_end()))
@@ -1841,7 +1842,6 @@ class basic_json // NOLINT(cppcoreguidelines-special-member-functions,hicpp-spec
             case value_t::null:
             case value_t::object:
             case value_t::array:
-            case value_t::binary:
             case value_t::discarded:
             default:
                 break;

single_include/nlohmann/json.hpp

@@ -19588,12 +19588,6 @@ class json_pointer
                         // "-" always fails the range check
                         return false;
                     }
-                    if (JSON_HEDLEY_UNLIKELY(reference_token.empty()))
-                    {
-                        // an empty reference token is not an array index; array_index()
-                        // would throw out_of_range.404 -- contains() must not throw (see #5395)
-                        return false;
-                    }
                     if (JSON_HEDLEY_UNLIKELY(reference_token.size() == 1 && !("0" <= reference_token && reference_token <= "9")))
                     {
                         // invalid char
@@ -27916,6 +27910,7 @@ class basic_json // NOLINT(cppcoreguidelines-special-member-functions,hicpp-spec
             case value_t::number_integer:
             case value_t::number_unsigned:
             case value_t::string:
+            case value_t::binary:
             {
                 if (JSON_HEDLEY_UNLIKELY(!first.m_it.primitive_iterator.is_begin()
                                          || !last.m_it.primitive_iterator.is_end()))
@@ -27928,7 +27923,6 @@ class basic_json // NOLINT(cppcoreguidelines-special-member-functions,hicpp-spec
             case value_t::null:
             case value_t::object:
             case value_t::array:
-            case value_t::binary:
             case value_t::discarded:
             default:
                 break;

tests/src/unit-constructor1.cpp

@@ -1648,6 +1648,20 @@ TEST_CASE("constructors")
                         CHECK_THROWS_WITH_AS(json(j.cbegin(), j.cbegin()), "[json.exception.invalid_iterator.204] iterators out of range", json::invalid_iterator&);
                     }
                 }
+
+                SECTION("binary")
+                {
+                    {
+                        json j = json::binary({1, 2, 3});
+                        CHECK_THROWS_WITH_AS(json(j.end(), j.end()), "[json.exception.invalid_iterator.204] iterators out of range", json::invalid_iterator&);
+                        CHECK_THROWS_WITH_AS(json(j.begin(), j.begin()), "[json.exception.invalid_iterator.204] iterators out of range", json::invalid_iterator&);
+                    }
+                    {
+                        json const j = json::binary({1, 2, 3});
+                        CHECK_THROWS_WITH_AS(json(j.cend(), j.cend()), "[json.exception.invalid_iterator.204] iterators out of range", json::invalid_iterator&);
+                        CHECK_THROWS_WITH_AS(json(j.cbegin(), j.cbegin()), "[json.exception.invalid_iterator.204] iterators out of range", json::invalid_iterator&);
+                    }
+                }
             }
         }
     }

tests/src/unit-json_pointer.cpp

@@ -380,26 +380,6 @@ TEST_CASE("JSON pointers")
 
             DOCTEST_MSVC_SUPPRESS_WARNING_POP
 
-            {
-                // contains() must not throw for an empty reference token if the current
-                // value is an array (cf. #5395) -- at() still reports out_of_range.404
-                json j_nested = {{"a", {1, 2}}};
-                const json& j_nested_const = j_nested;
-                json::json_pointer const jp("/a/");
-                std::string const throw_msg = "[json.exception.out_of_range.404] unresolved reference token ''";
-
-                CHECK_THROWS_WITH_AS(j_nested.at(jp), throw_msg.c_str(), json::out_of_range&);
-                CHECK_THROWS_WITH_AS(j_nested_const.at(jp), throw_msg.c_str(), json::out_of_range&);
-
-                CHECK(j_nested.contains(json::json_pointer("/a/1")));
-                CHECK(!j_nested.contains(jp));
-                CHECK(!j_nested_const.contains(jp));
-
-                // same for an empty reference token on a top-level array
-                CHECK(!j.contains(json::json_pointer("/")));
-                CHECK(!j_const.contains(json::json_pointer("/")));
-            }
-
             CHECK_THROWS_WITH_AS(j.at("/one"_json_pointer) = 1,
                                  "[json.exception.parse_error.109] parse error: array index 'one' is not a number", json::parse_error&);
             CHECK_THROWS_WITH_AS(j_const.at("/one"_json_pointer) == 1,