Replace std::equal with an explicitly-bounded loop in the move prefix check

The three-iterator std::equal(first1, last1, first2) form has no
explicit end iterator for the second range, which a static analyzer
(Flawfinder, CWE-126) flags as a potential over-read even though the
preceding size comparison already guarantees the second range is long
enough. Rather than argue the point, make the bound visible in the code
itself via an explicit loop -- every access to ptr.reference_tokens is
now guarded by the same index the loop condition bounds against
from_size.

(The C++14 four-iterator std::equal(first1, last1, first2, last2) form
was tried first as a more minimal fix, but this codebase targets C++11
and that overload is not safely usable under -std=c++11 with all
supported standard library implementations.)

Signed-off-by: Niels Lohmann <mail@nlohmann.me>

docs/mkdocs/docs/api/basic_json/patch.md

@@ -34,6 +34,10 @@ Strong guarantee: if an exception is thrown, there are no changes in the JSON va
   ("add", "remove", "move")
 - Throws [`out_of_range.411`](../../home/exceptions.md#jsonexceptionout_of_range411) if an "add" operation's target
   location has a parent that is neither an object nor an array.
+- Throws [`out_of_range.413`](../../home/exceptions.md#jsonexceptionout_of_range413) if a "remove" operation's target
+  location has a parent that is neither an object nor an array.
+- Throws [`out_of_range.414`](../../home/exceptions.md#jsonexceptionout_of_range414) if a "move" operation's "from"
+  location is a proper prefix of its "path" location.
 - Throws [`other_error.501`](../../home/exceptions.md#jsonexceptionother_error501) if "test" operation was
   unsuccessful.
 
@@ -75,3 +79,7 @@ is thrown. In any case, the original value is not changed: the patch is applied
 - Added in version 2.0.0.
 - Added [`out_of_range.411`](../../home/exceptions.md#jsonexceptionout_of_range411) and stopped relying on an internal assertion when an "add" operation's
   target location has a non-object/non-array parent in version 3.13.0.
+- Added [`out_of_range.413`](../../home/exceptions.md#jsonexceptionout_of_range413) and stopped silently ignoring a "remove" operation whose target
+  location has a non-object/non-array parent in version 3.13.0.
+- Added [`out_of_range.414`](../../home/exceptions.md#jsonexceptionout_of_range414) and rejected a "move" operation whose "from" location is a proper
+  prefix of its "path" location instead of silently producing a corrupted result in version 3.13.0.

docs/mkdocs/docs/api/basic_json/patch_inplace.md

@@ -30,6 +30,10 @@ No guarantees, value may be corrupted by an unsuccessful patch operation.
   ("add", "remove", "move")
 - Throws [`out_of_range.411`](../../home/exceptions.md#jsonexceptionout_of_range411) if an "add" operation's target
   location has a parent that is neither an object nor an array.
+- Throws [`out_of_range.413`](../../home/exceptions.md#jsonexceptionout_of_range413) if a "remove" operation's target
+  location has a parent that is neither an object nor an array.
+- Throws [`out_of_range.414`](../../home/exceptions.md#jsonexceptionout_of_range414) if a "move" operation's "from"
+  location is a proper prefix of its "path" location.
 - Throws [`other_error.501`](../../home/exceptions.md#jsonexceptionother_error501) if "test" operation was
   unsuccessful.
 
@@ -72,3 +76,7 @@ function throws an exception.
 - Added in version 3.11.0.
 - Added [`out_of_range.411`](../../home/exceptions.md#jsonexceptionout_of_range411) and stopped relying on an internal assertion when an "add" operation's
   target location has a non-object/non-array parent in version 3.13.0.
+- Added [`out_of_range.413`](../../home/exceptions.md#jsonexceptionout_of_range413) and stopped silently ignoring a "remove" operation whose target
+  location has a non-object/non-array parent in version 3.13.0.
+- Added [`out_of_range.414`](../../home/exceptions.md#jsonexceptionout_of_range414) and rejected a "move" operation whose "from" location is a proper
+  prefix of its "path" location instead of silently producing a corrupted result in version 3.13.0.

docs/mkdocs/docs/home/exceptions.md

@@ -933,6 +933,34 @@ BSON stores the length of documents, arrays, strings, and binary values in a sig
     [`to_bson`](../api/basic_json/to_bson.md) produced documents with negative length prefixes that
     [`from_bson`](../api/basic_json/from_bson.md) rejected.
 
+### json.exception.out_of_range.413
+
+A JSON Patch `remove` operation cannot be applied because the target location's parent is neither an object nor an array. Per [RFC 6902](https://datatracker.ietf.org/doc/html/rfc6902), a `remove` target must reference a member of an existing object or an element of an existing array; a primitive value (string, number, boolean, etc.) or `null` has no members or elements to remove.
+
+!!! failure "Example message"
+
+    ```
+    cannot remove value: the JSON Patch 'remove' target's parent is of type number, but must be an object or array
+    ```
+
+!!! note
+
+    This exception was added in version 3.13.0. Before that, this situation was silently ignored (the `remove` operation had no effect).
+
+### json.exception.out_of_range.414
+
+A JSON Patch `move` operation's `"from"` location is a proper prefix of its `"path"` location. Per [RFC 6902](https://datatracker.ietf.org/doc/html/rfc6902) (section 4.4), a location cannot be moved into one of its own children.
+
+!!! failure "Example message"
+
+    ```
+    cannot move value: 'from' path '/0' is a proper prefix of 'path' '/0/0'
+    ```
+
+!!! note
+
+    This exception was added in version 3.13.0. Before that, this situation could succeed with a corrupted result: for an array target, removing the "from" element before the "add" step shifted subsequent indices, so "path" silently re-resolved to a different element than intended.
+
 ## Further exceptions
 
 This exception is thrown in case of errors that cannot be classified with the

include/nlohmann/json.hpp

@@ -4939,6 +4939,12 @@ class basic_json // NOLINT(cppcoreguidelines-special-member-functions,hicpp-spec
                 // note erase performs range check
                 parent.erase(json_pointer::template array_index<basic_json_t>(last_path));
             }
+            else
+            {
+                // the parent of a "remove" target must be an object or array
+                // (see #5396)
+                JSON_THROW(out_of_range::create(413, detail::concat("cannot remove value: the JSON Patch 'remove' target's parent is of type ", parent.type_name(), ", but must be an object or array"), &parent));
+            }
         };
 
         // type check: top level value must be an array
@@ -5016,6 +5022,31 @@ class basic_json // NOLINT(cppcoreguidelines-special-member-functions,hicpp-spec
                     const auto from_path = get_value("move", "from", true).template get<string_t>();
                     json_pointer from_ptr(from_path);
 
+                    // RFC 6902 (section 4.4) forbids "from" from being a
+                    // proper prefix of "path": a location cannot be moved
+                    // into one of its own children. Compare the pointers'
+                    // reference tokens (already unescaped by json_pointer's
+                    // parser) rather than the raw pointer strings, since a
+                    // token may itself contain an escaped '/' or '~' that
+                    // would defeat a naive string-prefix comparison. This is
+                    // written as an explicit, manually-bounded loop (rather
+                    // than std::equal(first1, last1, first2), whose second
+                    // range has no explicit end iterator) so every access to
+                    // ptr.reference_tokens is visibly guarded by the same
+                    // index the loop condition already bounds against
+                    // from_size -- from_size < ptr.reference_tokens.size()
+                    // is checked once, up front, before the loop runs at all.
+                    const auto from_size = from_ptr.reference_tokens.size();
+                    bool from_is_proper_prefix_of_path = from_size < ptr.reference_tokens.size();
+                    for (std::size_t i = 0; from_is_proper_prefix_of_path && i < from_size; ++i)
+                    {
+                        from_is_proper_prefix_of_path = from_ptr.reference_tokens[i] == ptr.reference_tokens[i];
+                    }
+                    if (JSON_HEDLEY_UNLIKELY(from_is_proper_prefix_of_path))
+                    {
+                        JSON_THROW(out_of_range::create(414, detail::concat("cannot move value: 'from' path '", from_path, "' is a proper prefix of 'path' '", path, "'"), &result));
+                    }
+
                     // the "from" location must exist - use at()
                     basic_json const v = result.at(from_ptr);
 

single_include/nlohmann/json.hpp

@@ -26367,6 +26367,12 @@ class basic_json // NOLINT(cppcoreguidelines-special-member-functions,hicpp-spec
                 // note erase performs range check
                 parent.erase(json_pointer::template array_index<basic_json_t>(last_path));
             }
+            else
+            {
+                // the parent of a "remove" target must be an object or array
+                // (see #5396)
+                JSON_THROW(out_of_range::create(413, detail::concat("cannot remove value: the JSON Patch 'remove' target's parent is of type ", parent.type_name(), ", but must be an object or array"), &parent));
+            }
         };
 
         // type check: top level value must be an array
@@ -26444,6 +26450,31 @@ class basic_json // NOLINT(cppcoreguidelines-special-member-functions,hicpp-spec
                     const auto from_path = get_value("move", "from", true).template get<string_t>();
                     json_pointer from_ptr(from_path);
 
+                    // RFC 6902 (section 4.4) forbids "from" from being a
+                    // proper prefix of "path": a location cannot be moved
+                    // into one of its own children. Compare the pointers'
+                    // reference tokens (already unescaped by json_pointer's
+                    // parser) rather than the raw pointer strings, since a
+                    // token may itself contain an escaped '/' or '~' that
+                    // would defeat a naive string-prefix comparison. This is
+                    // written as an explicit, manually-bounded loop (rather
+                    // than std::equal(first1, last1, first2), whose second
+                    // range has no explicit end iterator) so every access to
+                    // ptr.reference_tokens is visibly guarded by the same
+                    // index the loop condition already bounds against
+                    // from_size -- from_size < ptr.reference_tokens.size()
+                    // is checked once, up front, before the loop runs at all.
+                    const auto from_size = from_ptr.reference_tokens.size();
+                    bool from_is_proper_prefix_of_path = from_size < ptr.reference_tokens.size();
+                    for (std::size_t i = 0; from_is_proper_prefix_of_path && i < from_size; ++i)
+                    {
+                        from_is_proper_prefix_of_path = from_ptr.reference_tokens[i] == ptr.reference_tokens[i];
+                    }
+                    if (JSON_HEDLEY_UNLIKELY(from_is_proper_prefix_of_path))
+                    {
+                        JSON_THROW(out_of_range::create(414, detail::concat("cannot move value: 'from' path '", from_path, "' is a proper prefix of 'path' '", path, "'"), &result));
+                    }
+
                     // the "from" location must exist - use at()
                     basic_json const v = result.at(from_ptr);
 

tests/CMakeLists.txt

@@ -177,24 +177,6 @@ json_test_add_test_for(src/unit-comparison.cpp
     MAIN test_main CXX_STANDARDS ${test_cxx_standards} ${test_force}
 )
 
-# test the parser again with JSON_DIAGNOSTIC_POSITIONS enabled
-json_test_set_test_options(test-class_parser_diagnostic_positions
-    COMPILE_DEFINITIONS JSON_DIAGNOSTIC_POSITIONS=1
-)
-json_test_add_test_for(src/unit-class_parser.cpp
-    NAME test-class_parser_diagnostic_positions
-    MAIN test_main CXX_STANDARDS ${test_cxx_standards} ${test_force}
-)
-
-# test diagnostic positions again without regular diagnostics (JSON pointer paths)
-json_test_set_test_options(test-diagnostic-positions_only
-    COMPILE_DEFINITIONS JSON_DIAGNOSTICS=0
-)
-json_test_add_test_for(src/unit-diagnostic-positions.cpp
-    NAME test-diagnostic-positions_only
-    MAIN test_main CXX_STANDARDS ${test_cxx_standards} ${test_force}
-)
-
 # *DO NOT* use json_test_set_test_options() below this line
 
 #############################################################################

tests/src/unit-class_parser.cpp

@@ -344,50 +344,6 @@ void trailing_comma_helper(const std::string& s)
     }
 }
 
-#if JSON_DIAGNOSTIC_POSITIONS
-/**
- * Validates that the generated JSON object is the same as expected
- * Validates that the start position and end position match the start and end of the string
- *
- * This check assumes that there is no whitespace around the json object in the original string.
- */
-void validate_generated_json_and_start_end_pos_helper(const std::string& original_string, const json& j, const json& check)
-{
-    CHECK(j == check);
-    CHECK(j.start_pos() == 0);
-    CHECK(j.end_pos() == original_string.size());
-}
-
-/**
- * Parses the root object from the given root string and validates that the start and end positions for the nested object are correct.
- *
- * This checks that whitespace around the nested object is included in the start and end positions of the root object.
- */
-void validate_start_end_pos_for_nested_obj_helper(const std::string& nested_type_json_str, const std::string& root_type_json_str, const json& expected_json, const json::parser_callback_t& cb = nullptr)
-{
-    json j;
-
-    // 1. If callback is provided, use callback version of parse()
-    if (cb)
-    {
-        j = json::parse(root_type_json_str, cb);
-    }
-    else
-    {
-        j = json::parse(root_type_json_str);
-    }
-
-    // 2. Check if the generated JSON is as expected
-    // Assumptions: The root_type_json_str does not have any whitespace around the json object
-    validate_generated_json_and_start_end_pos_helper(root_type_json_str, j, expected_json);
-
-    // 3. Get the nested object
-    const auto& nested = j["nested"];
-    // 4. Check if the start and end positions are generated correctly for nested objects and arrays
-    CHECK(nested_type_json_str == root_type_json_str.substr(nested.start_pos(), nested.end_pos() - nested.start_pos()));
-}
-#endif
-
 } // namespace
 
 TEST_CASE("parser class")
@@ -1823,228 +1779,6 @@ TEST_CASE("parser class")
         CHECK_THROWS_WITH_AS(_ = json::parse("/a", nullptr, true, true), "[json.exception.parse_error.101] parse error at line 1, column 2: syntax error while parsing value - invalid comment; expecting '/' or '*' after '/'; last read: '/a'", json::parse_error);
         CHECK_THROWS_WITH_AS(_ = json::parse("/*", nullptr, true, true), "[json.exception.parse_error.101] parse error at line 1, column 3: syntax error while parsing value - invalid comment; missing closing '*/'; last read: '/*<U+0000>'", json::parse_error);
     }
-
-#if JSON_DIAGNOSTIC_POSITIONS
-    // Macro for all test cases for start_pos and end_pos
-#define SETUP_TESTCASES() \
-    SECTION("with callback") \
-    { \
-        SECTION("filter nothing") \
-        { \
-            json::parser_callback_t const cb = [](int /*unused*/, json::parse_event_t /*unused*/, json& /*unused*/) noexcept \
-            { \
-                return true; \
-            }; \
-            validate_start_end_pos_for_nested_obj_helper(nested_type_json_str, root_type_json_str, expected, cb); \
-        } \
-        SECTION("filter element") \
-        { \
-            json::parser_callback_t const cb = [](int /*unused*/, json::parse_event_t event, json& j) noexcept \
-            { \
-                return (event != json::parse_event_t::key && event != json::parse_event_t::value) || j != json("a"); \
-            }; \
-            validate_start_end_pos_for_nested_obj_helper(nested_type_json_str, root_type_json_str, filteredExpected, cb); \
-        } \
-    } \
-    SECTION("without callback") \
-    { \
-        validate_start_end_pos_for_nested_obj_helper(nested_type_json_str, root_type_json_str, expected); \
-    }
-
-    SECTION("retrieve start position and end position")
-    {
-        SECTION("for object")
-        {
-            // Create an object with spaces to test the start and end positions. Spaces will not be included in the
-            // JSON object, however, the start and end positions should include the spaces from the input JSON string.
-            const std::string nested_type_json_str =  R"({    "a":       1,"b"      : "test1"})";
-            const std::string root_type_json_str =  R"({    "nested": )" + nested_type_json_str + R"(, "anotherValue": "test2"})";
-            auto expected = json({{"nested", {{"a", 1}, {"b", "test1"}}}, {"anotherValue", "test2"}});
-            auto filteredExpected = expected;
-            filteredExpected["nested"].erase("a");
-
-            SETUP_TESTCASES()
-        }
-
-        SECTION("for array")
-        {
-            const std::string nested_type_json_str =  R"(["a", "test", 45])";
-            const std::string root_type_json_str =  R"({   "nested": )" + nested_type_json_str + R"(, "anotherValue": "test" })";
-            auto expected = json({{"nested", {"a", "test", 45}}, {"anotherValue", "test"}});
-            auto filteredExpected = expected;
-            filteredExpected["nested"] = json({"test", 45});
-            SETUP_TESTCASES()
-        }
-
-        SECTION("for array with objects")
-        {
-            const std::string nested_type_json_str =  R"([{"a": 1, "b": "test"}, {"c": 2, "d": "test2"}])";
-            const std::string root_type_json_str =  R"({   "nested": )" + nested_type_json_str + R"(, "anotherValue": "test" })";
-            auto expected = json({{"nested", {{{"a", 1}, {"b", "test"}}, {{"c", 2}, {"d", "test2"}}}}, {"anotherValue", "test"}});
-            auto filteredExpected = expected;
-            filteredExpected["nested"][0].erase("a");
-            SETUP_TESTCASES()
-
-            auto j = json::parse(root_type_json_str);
-            auto nested_array = j["nested"];
-            const auto& nested_obj = nested_array[0];
-            CHECK(nested_type_json_str.substr(1, 21) == root_type_json_str.substr(nested_obj.start_pos(), nested_obj.end_pos() - nested_obj.start_pos()));
-            CHECK(nested_type_json_str.substr(24, 22) == root_type_json_str.substr(nested_array[1].start_pos(), nested_array[1].end_pos() - nested_array[1].start_pos()));
-        }
-
-        SECTION("for two levels of nesting objects")
-        {
-            const std::string nested_type_json_str =  R"({"nested2": {"b": "test"}})";
-            const std::string root_type_json_str =  R"({   "a": 2, "nested": )" + nested_type_json_str + R"(, "anotherValue": "test" })";
-            auto expected = json({{"a", 2}, {"nested", {{"nested2", {{"b", "test"}}}}}, {"anotherValue", "test"}});
-            auto filteredExpected = expected;
-            filteredExpected.erase("a");
-            SETUP_TESTCASES()
-
-            auto j = json::parse(root_type_json_str);
-            auto nested_obj = j["nested"]["nested2"];
-            CHECK(nested_type_json_str.substr(12, 13) == root_type_json_str.substr(nested_obj.start_pos(), nested_obj.end_pos() - nested_obj.start_pos()));
-        }
-
-        SECTION("for simple types")
-        {
-            SECTION("no nested")
-            {
-                SECTION("with callback")
-                {
-                    json::parser_callback_t const cb = [](int /*unused*/, json::parse_event_t /*unused*/, json& /*unused*/) noexcept
-                    {
-                        return true;
-                    };
-
-                    // 1. string type
-                    std::string json_str =  R"("test")";
-                    auto j = json::parse(json_str, cb);
-                    validate_generated_json_and_start_end_pos_helper(json_str, j, "test");
-
-                    // 2. number type
-                    json_str =  R"(1)";
-                    j = json::parse(json_str, cb);
-                    validate_generated_json_and_start_end_pos_helper(json_str, j, 1);
-
-                    // 3. boolean type
-                    json_str =  R"(true)";
-                    j = json::parse(json_str, cb);
-                    validate_generated_json_and_start_end_pos_helper(json_str, j, true);
-
-                    // 4. null type
-                    json_str =  R"(null)";
-                    j = json::parse(json_str, cb);
-                    validate_generated_json_and_start_end_pos_helper(json_str, j, nullptr);
-                }
-
-                SECTION("without callback")
-                {
-                    // 1. string type
-                    std::string json_str =  R"("test")";
-                    auto j = json::parse(json_str);
-                    validate_generated_json_and_start_end_pos_helper(json_str, j, "test");
-
-                    // 2. number type
-                    json_str =  R"(1)";
-                    j = json::parse(json_str);
-                    validate_generated_json_and_start_end_pos_helper(json_str, j, 1);
-
-                    json_str = R"(1.001239923)";
-                    j = json::parse(json_str);
-                    validate_generated_json_and_start_end_pos_helper(json_str, j, 1.001239923);
-
-                    json_str = R"(1.123812389000000)";
-                    j = json::parse(json_str);
-                    validate_generated_json_and_start_end_pos_helper(json_str, j, 1.123812389);
-
-                    // 3. boolean type
-                    json_str =  R"(true)";
-                    j = json::parse(json_str);
-                    validate_generated_json_and_start_end_pos_helper(json_str, j, true);
-
-                    json_str =  R"(false)";
-                    j = json::parse(json_str);
-                    validate_generated_json_and_start_end_pos_helper(json_str, j, false);
-
-                    // 4. null type
-                    json_str =  R"(null)";
-                    j = json::parse(json_str);
-                    validate_generated_json_and_start_end_pos_helper(json_str, j, nullptr);
-                }
-            }
-
-            SECTION("string type")
-            {
-                const std::string nested_type_json_str =  R"("test")";
-                const std::string root_type_json_str =  R"({ "a": 1,   "nested": )" + nested_type_json_str + R"(, "anotherValue": "test" })";
-                auto expected = json({{"nested", "test"}, {"anotherValue", "test"}, {"a", 1}});
-                auto filteredExpected = expected;
-                filteredExpected.erase("a");
-                SETUP_TESTCASES()
-            }
-
-            SECTION("number type")
-            {
-                const std::string nested_type_json_str =  R"(2)";
-                const std::string root_type_json_str =  R"({ "a": 1,   "nested": )" + nested_type_json_str + R"(, "anotherValue": "test" })";
-                auto expected = json({{"nested", 2}, {"anotherValue", "test"}, {"a", 1}});
-                auto filteredExpected = expected;
-                filteredExpected.erase("a");
-                SETUP_TESTCASES()
-            }
-
-            SECTION("boolean type")
-            {
-                const std::string nested_type_json_str =  R"(true)";
-                const std::string root_type_json_str =  R"({ "a": 1,   "nested": )" + nested_type_json_str + R"(, "anotherValue": "test" })";
-                auto expected = json({{"nested", true}, {"anotherValue", "test"}, {"a", 1}});
-                auto filteredExpected = expected;
-                filteredExpected.erase("a");
-                SETUP_TESTCASES()
-            }
-
-            SECTION("null type")
-            {
-                const std::string nested_type_json_str =  R"(null)";
-                const std::string root_type_json_str =  R"({ "a": 1,   "nested": )" + nested_type_json_str + R"(, "anotherValue": "test" })";
-                auto expected = json({{"nested", nullptr}, {"anotherValue", "test"}, {"a", 1}});
-                auto filteredExpected = expected;
-                filteredExpected.erase("a");
-                SETUP_TESTCASES()
-            }
-        }
-        SECTION("with leading whitespace and newlines around root JSON")
-        {
-            const std::string initial_whitespace = R"(
-                
-            )";
-            const std::string nested_type_json_str = R"({
-                "a": 1,
-                "nested": {
-                    "b": "test"
-                },
-                "anotherValue": "test"
-            })";
-            const std::string end_whitespace = R"(
-                
-            )";
-            const std::string root_type_json_str = initial_whitespace + nested_type_json_str + end_whitespace;
-
-            auto expected = json({{"a", 1}, {"nested", {{"b", "test"}}}, {"anotherValue", "test"}});
-
-            auto j = json::parse(root_type_json_str);
-
-            // 2. Check if the generated JSON is as expected
-            CHECK(j == expected);
-
-            // 3. Check if the start and end positions do not include the surrounding whitespace
-            CHECK(j.start_pos() == initial_whitespace.size());
-            CHECK(j.end_pos() == root_type_json_str.size() - end_whitespace.size());
-        }
-    }
-#undef SETUP_TESTCASES
-#endif
 }
 
 // this test relies on parse errors being thrown, so it is skipped when

tests/src/unit-diagnostic-positions-only.cpp

@@ -0,0 +1,44 @@
+//     __ _____ _____ _____
+//  __|  |   __|     |   | |  JSON for Modern C++ (supporting code)
+// |  |  |__   |  |  | | | |  version 3.12.0
+// |_____|_____|_____|_|___|  https://github.com/nlohmann/json
+//
+// SPDX-FileCopyrightText: 2013-2026 Niels Lohmann <https://nlohmann.me>
+// SPDX-License-Identifier: MIT
+
+#include "doctest_compatibility.h"
+
+#ifdef JSON_DIAGNOSTICS
+    #undef JSON_DIAGNOSTICS
+#endif
+
+#define JSON_DIAGNOSTICS 0
+#define JSON_DIAGNOSTIC_POSITIONS 1
+#include <nlohmann/json.hpp>
+
+using json = nlohmann::json;
+
+TEST_CASE("Better diagnostics with positions only")
+{
+    SECTION("invalid type")
+    {
+        const std::string json_invalid_string = R"(
+        {
+            "address": {
+                "street": "Fake Street",
+                "housenumber": "1"
+            }
+        }
+        )";
+        json j = json::parse(json_invalid_string);
+        CHECK_THROWS_WITH_AS(j.at("address").at("housenumber").get<int>(),
+                             "[json.exception.type_error.302] (bytes 108-111) type must be number, but is string", json::type_error);
+    }
+
+    SECTION("invalid type without positions")
+    {
+        const json j = "foo";
+        CHECK_THROWS_WITH_AS(j.get<int>(),
+                             "[json.exception.type_error.302] type must be number, but is string", json::type_error);
+    }
+}

tests/src/unit-diagnostic-positions.cpp

@@ -8,9 +8,7 @@
 
 #include "doctest_compatibility.h"
 
-#ifndef JSON_DIAGNOSTICS
-    #define JSON_DIAGNOSTICS 1
-#endif
+#define JSON_DIAGNOSTICS 1
 #define JSON_DIAGNOSTIC_POSITIONS 1
 #include <nlohmann/json.hpp>
 
@@ -29,13 +27,8 @@ TEST_CASE("Better diagnostics with positions")
         }
         )";
         json j = json::parse(json_invalid_string);
-#if JSON_DIAGNOSTICS
         CHECK_THROWS_WITH_AS(j.at("address").at("housenumber").get<int>(),
                              "[json.exception.type_error.302] (/address/housenumber) (bytes 108-111) type must be number, but is string", json::type_error);
-#else
-        CHECK_THROWS_WITH_AS(j.at("address").at("housenumber").get<int>(),
-                             "[json.exception.type_error.302] (bytes 108-111) type must be number, but is string", json::type_error);
-#endif
     }
 
     SECTION("invalid type without positions")
@@ -81,12 +74,7 @@ TEST_CASE("Better diagnostics with positions")
         // (/foo/bar); the position of that parent is reported in the message
         const json doc = json::parse(R"({"foo":{"bar":"a string"}})");
         const json patch = json::parse(R"([{"op":"add","path":"/foo/bar/baz","value":1}])");
-#if JSON_DIAGNOSTICS
         CHECK_THROWS_WITH_AS(doc.patch(patch),
                              "[json.exception.out_of_range.411] (/foo/bar) (bytes 14-24) cannot add value: the JSON Patch 'add' target's parent is of type string, but must be an object or array", json::out_of_range);
-#else
-        CHECK_THROWS_WITH_AS(doc.patch(patch),
-                             "[json.exception.out_of_range.411] (bytes 14-24) cannot add value: the JSON Patch 'add' target's parent is of type string, but must be an object or array", json::out_of_range);
-#endif
     }
 }

tests/src/unit-json_patch.cpp

@@ -1389,6 +1389,172 @@ TEST_CASE("JSON patch - add to a primitive parent (regression #4292)")
     }
 }
 
+TEST_CASE("JSON patch - remove with primitive or null parent (regression #5396)")
+{
+    // Regression test for https://github.com/nlohmann/json/issues/5396
+    //
+    // RFC 6902 (§4.2) requires the target location of a "remove" operation
+    // to exist. When the target's parent resolves to a primitive value or
+    // null, the operation must fail. Previously operation_remove silently
+    // did nothing in this case (neither the "is_object" nor the "is_array"
+    // branch matched, and there was no final "else"), so the patch appeared
+    // to succeed without changing the document. It now throws
+    // out_of_range.413.
+
+    SECTION("parent is a primitive (number)")
+    {
+        json const doc = {{"a", 1}};
+        json const patch = {{{"op", "remove"}, {"path", "/a/b"}}};
+#if JSON_DIAGNOSTICS
+        CHECK_THROWS_WITH_AS(doc.patch(patch), "[json.exception.out_of_range.413] (/a) cannot remove value: the JSON Patch 'remove' target's parent is of type number, but must be an object or array", json::out_of_range&);
+#else
+        CHECK_THROWS_WITH_AS(doc.patch(patch), "[json.exception.out_of_range.413] cannot remove value: the JSON Patch 'remove' target's parent is of type number, but must be an object or array", json::out_of_range&);
+#endif
+    }
+
+    SECTION("parent is a primitive (string)")
+    {
+        json const doc = {{"foo", {{"bar", "a string"}}}};
+        json const patch = {{{"op", "remove"}, {"path", "/foo/bar/baz"}}};
+#if JSON_DIAGNOSTICS
+        CHECK_THROWS_WITH_AS(doc.patch(patch), "[json.exception.out_of_range.413] (/foo/bar) cannot remove value: the JSON Patch 'remove' target's parent is of type string, but must be an object or array", json::out_of_range&);
+#else
+        CHECK_THROWS_WITH_AS(doc.patch(patch), "[json.exception.out_of_range.413] cannot remove value: the JSON Patch 'remove' target's parent is of type string, but must be an object or array", json::out_of_range&);
+#endif
+    }
+
+    SECTION("top-level document is null")
+    {
+        json const doc = nullptr;
+        json const patch = {{{"op", "remove"}, {"path", "/a"}}};
+        CHECK_THROWS_WITH_AS(doc.patch(patch), "[json.exception.out_of_range.413] cannot remove value: the JSON Patch 'remove' target's parent is of type null, but must be an object or array", json::out_of_range&);
+    }
+
+    SECTION("legitimate removes still work")
+    {
+        // object member
+        json const doc1 = {{"a", 1}, {"b", 2}};
+        json const patch1 = {{{"op", "remove"}, {"path", "/a"}}};
+        CHECK(doc1.patch(patch1) == json({{"b", 2}}));
+
+        // array element
+        json const doc2 = R"([1, 2, 3])"_json;
+        json const patch2 = {{{"op", "remove"}, {"path", "/1"}}};
+        CHECK(doc2.patch(patch2) == R"([1, 3])"_json);
+    }
+}
+
+TEST_CASE("JSON patch - move where 'from' is a proper prefix of 'path' (regression #5397)")
+{
+    // Regression test for https://github.com/nlohmann/json/issues/5397
+    //
+    // RFC 6902 (§4.4) forbids "from" from being a proper prefix of "path"
+    // for a "move" operation: "a location cannot be moved into one of its
+    // children." "move" is implemented as remove-then-add; for an object
+    // target this happened to throw anyway as a side effect of the "add"
+    // step re-resolving through the now-removed parent, but for an array
+    // target the removal shifted subsequent indices, so "path" silently
+    // re-resolved to a different element and the operation "succeeded"
+    // with a corrupted result. It now throws out_of_range.414 for both
+    // object and array targets.
+
+    SECTION("array target (from the issue)")
+    {
+        json const doc = R"([[1,2],[3]])"_json;
+        json const patch = {{{"op", "move"}, {"from", "/0"}, {"path", "/0/0"}}};
+        CHECK_THROWS_WITH_AS(doc.patch(patch), "[json.exception.out_of_range.414] cannot move value: 'from' path '/0' is a proper prefix of 'path' '/0/0'", json::out_of_range&);
+    }
+
+    SECTION("object target")
+    {
+        json const doc = R"({"a": {"b": 1}})"_json;
+        json const patch = {{{"op", "move"}, {"from", "/a"}, {"path", "/a/b"}}};
+        CHECK_THROWS_WITH_AS(doc.patch(patch), "[json.exception.out_of_range.414] cannot move value: 'from' path '/a' is a proper prefix of 'path' '/a/b'", json::out_of_range&);
+    }
+
+    SECTION("from == path is not a proper prefix and must not be rejected")
+    {
+        // "from" equal to "path" is a no-op move; it is not a *proper*
+        // prefix relationship, so this new check must not reject it.
+        json const doc = R"({"a": 1, "b": 2})"_json;
+        json const patch = {{{"op", "move"}, {"from", "/a"}, {"path", "/a"}}};
+        CHECK(doc.patch(patch) == doc);
+    }
+
+    SECTION("raw string prefix that is not a pointer-token prefix must be allowed")
+    {
+        // "/ab" is a string-prefix of "/abc/x" as raw text, but "ab" and
+        // "abc" are different reference tokens, so this is NOT a
+        // pointer-token prefix relationship and the move must succeed.
+        // This is the key case proving the check compares tokens, not
+        // raw pointer text (a naive std::string prefix/rfind check on
+        // the undecoded pointer would wrongly reject this).
+        json const doc = R"({"ab": 1, "abc": {"x": 2}})"_json;
+        json const patch = {{{"op", "move"}, {"from", "/ab"}, {"path", "/abc/x"}}};
+        json const result = R"({"abc": {"x": 1}})"_json;
+        CHECK(doc.patch(patch) == result);
+    }
+
+    SECTION("escaped reference tokens are compared unescaped")
+    {
+        // "from" is the single token "a/b" (escaped as "a~1b"); "path"
+        // addresses member "x" of that same value, so "from" is a
+        // proper (token-level) prefix of "path" and must be rejected.
+        json const doc = R"({"a/b": {"x": 1}})"_json;
+        json const patch = {{{"op", "move"}, {"from", "/a~1b"}, {"path", "/a~1b/x"}}};
+        CHECK_THROWS_WITH_AS(doc.patch(patch), "[json.exception.out_of_range.414] cannot move value: 'from' path '/a~1b' is a proper prefix of 'path' '/a~1b/x'", json::out_of_range&);
+    }
+
+    SECTION("ordinary valid moves still work")
+    {
+        // unrelated top-level members
+        json const doc1 = R"({"a": 1, "b": 2})"_json;
+        json const patch1 = {{{"op", "move"}, {"from", "/a"}, {"path", "/c"}}};
+        CHECK(doc1.patch(patch1) == R"({"b": 2, "c": 1})"_json);
+
+        // sibling paths that share a textual prefix but are unrelated
+        json const doc2 = R"({"a": {"x": 1}, "b": {"y": 2}})"_json;
+        json const patch2 = {{{"op", "move"}, {"from", "/a/x"}, {"path", "/b/z"}}};
+        CHECK(doc2.patch(patch2) == R"({"a": {}, "b": {"y": 2, "z": 1}})"_json);
+
+        // "path" is a proper prefix of "from" (the reverse relationship,
+        // which RFC 6902 does not forbid)
+        json const doc3 = R"({"a": {"b": 1}})"_json;
+        json const patch3 = {{{"op", "move"}, {"from", "/a/b"}, {"path", "/a"}}};
+        CHECK(doc3.patch(patch3) == R"({"a": 1})"_json);
+    }
+
+    SECTION("root 'from' is a proper prefix of every non-root 'path'")
+    {
+        // the whole document is a proper prefix of any location inside it
+        json const doc = R"({"a": 1})"_json;
+        json const patch = {{{"op", "move"}, {"from", ""}, {"path", "/a"}}};
+        CHECK_THROWS_WITH_AS(doc.patch(patch), "[json.exception.out_of_range.414] cannot move value: 'from' path '' is a proper prefix of 'path' '/a'", json::out_of_range&);
+    }
+
+    SECTION("root 'path' is never a proper prefix violation for a non-root 'from'")
+    {
+        // the reverse of the above: moving a non-root location to the root
+        // is the "path is a prefix of from" relationship, which RFC 6902
+        // permits (already covered generally above; this pins the root
+        // case specifically, since root is the one path with no reference
+        // tokens at all)
+        json const doc = R"({"a": {"b": 1}})"_json;
+        json const patch = {{{"op", "move"}, {"from", "/a"}, {"path", ""}}};
+        CHECK(doc.patch(patch) == R"({"b": 1})"_json);
+    }
+
+    SECTION("the array-append token '-' is an ordinary child token")
+    {
+        // "-" (append-to-array) addresses a location *inside* the array,
+        // so "from" pointing at the array is still a proper prefix of
+        // "path" ending in "-" and must be rejected like any other child.
+        json const doc = R"({"a": [1, 2]})"_json;
+        json const patch = {{{"op", "move"}, {"from", "/a"}, {"path", "/a/-"}}};
+        CHECK_THROWS_WITH_AS(doc.patch(patch), "[json.exception.out_of_range.414] cannot move value: 'from' path '/a' is a proper prefix of 'path' '/a/-'", json::out_of_range&);
+    }
+}
+
 TEST_CASE("JSON patch - diff emits array removals in descending index order")
 {
     SECTION("array shrunk to empty")