Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package lua-dkjson for openSUSE:Factory checked in at 2026-10-29 16:06:39 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/lua-dkjson (Old) and /work/SRC/openSUSE:Factory/.lua-dkjson.new.1255 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "lua-dkjson" Thu Oct 29 16:06:39 2026 rev:9 rq:1393485 version:2.11.0 Changes: -------- --- /work/SRC/openSUSE:Factory/lua-dkjson/lua-dkjson.changes 2026-03-03 15:31:09.229595353 +0100 +++ /work/SRC/openSUSE:Factory/.lua-dkjson.new.1255/lua-dkjson.changes 2026-10-29 16:10:30.005528479 +0100 @@ -1,0 +2,17 @@ +Wed Oct 28 21:46:44 UTC 2026 - Matej Cepl <[email protected]> + +- Update to 2.11: + - Fix another regression introduced to the pure-Lua decoder in 2.9: + Certain inputs can result in the decode function to raise an error instead + of returning nil. Depending on the circumstances this can also be used as + a denial-of-service attack. + - In response to those regressions, I have extended the test script with + some basic fuzzing tests. +- Update to 2.10: + - Fix regression in the pure-Lua decoder introduced in 2.9: + This is a security vulnerability enabling denial-of-service attacks + (unterminated loop) with a well-crafted (invalid JSON) input string. +- Update to 2.9: + - Performance improvements for the pure-Lua decoder. + +------------------------------------------------------------------- Old: ---- dkjson-2.8.tar.gz New: ---- dkjson-2.11.tar.gz ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ lua-dkjson.spec ++++++ --- /var/tmp/diff_new_pack.VZY2kz/_old 2026-10-29 16:10:32.853647921 +0100 +++ /var/tmp/diff_new_pack.VZY2kz/_new 2026-10-29 16:10:32.854647963 +0100 @@ -18,16 +18,18 @@ %define flavor @BUILD_FLAVOR@ %define mod_name dkjson -%define uptag 2.8 -Version: 2.8.0 +%define uptag 2.11 +Version: 2.11.0 Release: 0 Summary: David Kolf's JSON module for Lua License: MIT Group: Development/Libraries/Other -URL: http://dkjson.org/ -Source: http://dkolf.de/dkjson-lua/dkjson-%{uptag}.tar.gz +URL: https://dkjson.org/ +Source: https://dkolf.de/dkjson-lua/dkjson-%{uptag}.tar.gz BuildRequires: %{flavor}-devel BuildRequires: lua-macros +# For testing +BuildRequires: glibc-locale Requires: %{flavor} Requires: %{flavor}-lpeg BuildArch: noarch @@ -64,6 +66,6 @@ %files # license is included in readme.txt file -%doc versions.txt readme.txt +%doc versions.md readme.md %{lua_noarchdir}/%{mod_name}* ++++++ _scmsync.obsinfo ++++++ --- /var/tmp/diff_new_pack.VZY2kz/_old 2026-10-29 16:10:32.906650144 +0100 +++ /var/tmp/diff_new_pack.VZY2kz/_new 2026-10-29 16:10:32.909650270 +0100 @@ -1,6 +1,6 @@ -mtime: 1769204277 -commit: 0f3b0bc52207f554af5f797bbff30093af5fc4ba272aaf57185d81e97aedb169 -url: https://src.opensuse.org/lua/lua-dkjson.git -revision: 0f3b0bc52207f554af5f797bbff30093af5fc4ba272aaf57185d81e97aedb169 +mtime: 1793224572 +commit: 11757d5bf8972afcff1b423104fadadf446b581719b65c08ff301a306278213d +url: https://src.opensuse.org/lua/lua-dkjson +revision: 11757d5bf8972afcff1b423104fadadf446b581719b65c08ff301a306278213d projectscmsync: https://src.opensuse.org/lua/_ObsPrj.git ++++++ build.specials.obscpio ++++++ ++++++ build.specials.obscpio ++++++ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/.gitignore new/.gitignore --- old/.gitignore 1970-01-01 01:00:00.000000000 +0100 +++ new/.gitignore 2026-10-28 22:56:12.000000000 +0100 @@ -0,0 +1 @@ +.osc ++++++ dkjson-2.8.tar.gz -> dkjson-2.11.tar.gz ++++++ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/dkjson-2.8/dkjson-2.11-1.rockspec new/dkjson-2.11/dkjson-2.11-1.rockspec --- old/dkjson-2.8/dkjson-2.11-1.rockspec 1970-01-01 01:00:00.000000000 +0100 +++ new/dkjson-2.11/dkjson-2.11-1.rockspec 2026-07-27 22:38:09.000000000 +0200 @@ -0,0 +1,30 @@ +package = "dkjson" +version = "2.11-1" +source = { + url = "https://dkolf.de/dkjson-lua/dkjson-2.11.tar.gz";, + file = "dkjson-2.11.tar.gz" +} +description = { + summary = "David Kolf's JSON module for Lua", + detailed = [[ +dkjson is a module for encoding and decoding JSON data. It supports UTF-8. + +JSON (JavaScript Object Notation) is a format for serializing data based +on the syntax for JavaScript data structures. + +dkjson is written in Lua without any dependencies, but +when LPeg is available dkjson can use it to speed up decoding. +]], + homepage = "https://dkolf.de/dkjson-lua/";, + license = "MIT/X11" +} +dependencies = { + "lua >= 5.1, < 5.6" +} +build = { + type = "builtin", + modules = { + dkjson = "dkjson.lua" + } +} + diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/dkjson-2.8/dkjson-2.8-1.rockspec new/dkjson-2.11/dkjson-2.8-1.rockspec --- old/dkjson-2.8/dkjson-2.8-1.rockspec 2024-06-17 21:36:32.000000000 +0200 +++ new/dkjson-2.11/dkjson-2.8-1.rockspec 1970-01-01 01:00:00.000000000 +0100 @@ -1,30 +0,0 @@ -package = "dkjson" -version = "2.8-1" -source = { - url = "http://dkolf.de/dkjson-lua/dkjson-2.8.tar.gz";, - file = "dkjson-2.8.tar.gz" -} -description = { - summary = "David Kolf's JSON module for Lua", - detailed = [[ -dkjson is a module for encoding and decoding JSON data. It supports UTF-8. - -JSON (JavaScript Object Notation) is a format for serializing data based -on the syntax for JavaScript data structures. - -dkjson is written in Lua without any dependencies, but -when LPeg is available dkjson can use it to speed up decoding. -]], - homepage = "http://dkolf.de/dkjson-lua/";, - license = "MIT/X11" -} -dependencies = { - "lua >= 5.1, < 5.5" -} -build = { - type = "builtin", - modules = { - dkjson = "dkjson.lua" - } -} - diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/dkjson-2.8/dkjson.lua new/dkjson-2.11/dkjson.lua --- old/dkjson-2.8/dkjson.lua 2024-06-17 21:36:32.000000000 +0200 +++ new/dkjson-2.11/dkjson.lua 2026-07-27 22:38:09.000000000 +0200 @@ -5,9 +5,9 @@ --[==[ -David Kolf's JSON module for Lua 5.1 - 5.4 +David Kolf's JSON module for Lua 5.1 - 5.5 -Version 2.8 +Version 2.11 For the documentation see the corresponding readme.txt or visit @@ -17,7 +17,7 @@ domain 'dkolf.de'. -Copyright (C) 2010-2024 David Heiko Kolf +Copyright (C) 2010-2026 David Heiko Kolf Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the @@ -52,7 +52,7 @@ local strmatch = string.match local concat = table.concat -local json = { version = "dkjson 2.8" } +local json = { version = "dkjson 2.11" } local jsonlpeg = {} @@ -405,21 +405,26 @@ local function scanwhite (str, pos) while true do - pos = strfind (str, "%S", pos) - if not pos then return nil end - local sub2 = strsub (str, pos, pos + 1) - if sub2 == "\239\187" and strsub (str, pos + 2, pos + 2) == "\191" then + pos = strmatch (str, "%s*()", pos) + local n1, n2, n3 = strbyte (str, pos, pos + 2) + if n1 == 239 and n2 == 187 and n3 == 191 then -- UTF-8 Byte Order Mark pos = pos + 3 - elseif sub2 == "//" then - pos = strfind (str, "[\n\r]", pos + 2) - if not pos then return nil end - elseif sub2 == "/*" then - pos = strfind (str, "*/", pos + 2) - if not pos then return nil end - pos = pos + 2 + elseif n1 == 47 then + if n2 == 47 then -- "//" + pos = strfind (str, "[\n\r]", pos + 2) + if not pos then return nil end + elseif n2 == 42 then -- "/*" + pos = strfind (str, "*/", pos + 2) + if not pos then return nil end + pos = pos + 2 + else + return pos, n1 + end + elseif n1 == nil then + return nil else - return pos + return pos, n1 end end end @@ -463,7 +468,7 @@ n = n + 1 buffer[n] = strsub (str, lastpos, nextpos - 1) end - if strsub (str, nextpos, nextpos) == "\"" then + if strbyte (str, nextpos) == 34 then -- '"' lastpos = nextpos + 1 break else @@ -514,83 +519,139 @@ local scanvalue -- forward declaration -local function scantable (what, closechar, str, startpos, nullval, objectmeta, arraymeta) - local tbl, n = {}, 0 +local function scanobject (str, startpos, nullval, objectmeta, arraymeta) + local tbl = setmetatable ({}, objectmeta) local pos = startpos + 1 - if what == 'object' then - setmetatable (tbl, objectmeta) - else - setmetatable (tbl, arraymeta) - end + while true do - pos = scanwhite (str, pos) - if not pos then return unterminated (str, what, startpos) end - local char = strsub (str, pos, pos) - if char == closechar then + local char + pos, char = scanwhite (str, pos) + local key, err + if char == 34 then -- '"' + key, pos, err = scanstring (str, pos) + elseif char == 125 then -- "}" return tbl, pos + 1 + elseif not pos then + return unterminated (str, "object", startpos) + else + return nil, pos, "invalid key at " .. loc (str, pos) + end + if err then return nil, pos, err end + + char = strbyte (str, pos) + if char ~= 58 then -- ":" + pos, char = scanwhite (str, pos) + if not pos then + return unterminated (str, "object", startpos) + elseif char ~= 58 then + return nil, pos, "missing colon at " .. loc (str, pos) + end end - local val1, err - val1, pos, err = scanvalue (str, pos, nullval, objectmeta, arraymeta) + + pos = scanwhite (str, pos + 1) + if not pos then return unterminated (str, "object", startpos) end + local val + val, pos, err = scanvalue (str, pos, nullval, objectmeta, arraymeta) if err then return nil, pos, err end - pos = scanwhite (str, pos) - if not pos then return unterminated (str, what, startpos) end - char = strsub (str, pos, pos) - if char == ":" then - if val1 == nil then - return nil, pos, "cannot use nil as table index (at " .. loc (str, pos) .. ")" - end - pos = scanwhite (str, pos + 1) - if not pos then return unterminated (str, what, startpos) end - local val2 - val2, pos, err = scanvalue (str, pos, nullval, objectmeta, arraymeta) - if err then return nil, pos, err end - tbl[val1] = val2 - pos = scanwhite (str, pos) - if not pos then return unterminated (str, what, startpos) end - char = strsub (str, pos, pos) + tbl[key] = val + + char = strbyte (str, pos) + if char == 44 then -- "," + pos = pos + 1 else - n = n + 1 - tbl[n] = val1 + pos, char = scanwhite (str, pos) + + if char == 44 then + pos = pos + 1 + elseif not pos then + return unterminated (str, "object", startpos) + end end - if char == "," then + end +end + +local function scanarray (str, startpos, nullval, objectmeta, arraymeta) + local tbl, n = setmetatable ({}, arraymeta), 0 + local pos = startpos + 1 + + while true do + local char + pos, char = scanwhite (str, pos) + + if char == 93 then -- "]" + return tbl, pos + 1 + elseif not pos then + return unterminated (str, "array", startpos) + end + + local val, err + val, pos, err = scanvalue (str, pos, nullval, objectmeta, arraymeta) + if err then return nil, pos, err end + n = n + 1 + tbl[n] = val + + char = strbyte (str, pos) + if char == 44 then -- "," pos = pos + 1 + else + pos, char = scanwhite (str, pos) + + if char == 44 then + pos = pos + 1 + elseif not pos then + return unterminated (str, "array", startpos) + end end end end +local function scaninvalid (str, pos) + return nil, pos, "no valid JSON value at " .. loc (str, pos) +end + +local function scanliteral (str, pos, expected, value) + local pstart, pend = strfind (str, "^%a%w*", pos) + local name = strsub (str, pstart, pend) + if name == expected then + return value, pend + 1 + else + return scaninvalid (str, pos) + end +end + +local function scannumber (str, pos) + local pstart, pend = strfind (str, "^%-?[%d%.]*[eE]?[%+%-]?%d*", pos) + local number = str2num (strsub (str, pstart, pend)) + if number then + return number, pend + 1 + else + return scaninvalid (str, pos) + end +end + scanvalue = function (str, pos, nullval, objectmeta, arraymeta) pos = pos or 1 - pos = scanwhite (str, pos) + local c + pos, c = scanwhite (str, pos) + if not pos then return nil, strlen (str) + 1, "no valid JSON value (reached the end)" - end - local char = strsub (str, pos, pos) - if char == "{" then - return scantable ('object', "}", str, pos, nullval, objectmeta, arraymeta) - elseif char == "[" then - return scantable ('array', "]", str, pos, nullval, objectmeta, arraymeta) - elseif char == "\"" then + elseif c == 34 then -- '"' return scanstring (str, pos) + elseif c == 123 then -- "{" + return scanobject (str, pos, nullval, objectmeta, arraymeta) + elseif c == 91 then -- "[" + return scanarray (str, pos, nullval, objectmeta, arraymeta) + elseif c == 45 or (c >= 48 and c <= 57) then -- "-", "0"..."9" + return scannumber (str, pos) + elseif c == 116 then -- "t" + return scanliteral (str, pos, "true", true) + elseif c == 102 then -- "f" + return scanliteral (str, pos, "false", false) + elseif c == 110 then -- "n" + return scanliteral (str, pos, "null", nullval) else - local pstart, pend = strfind (str, "^%-?[%d%.]+[eE]?[%+%-]?%d*", pos) - if pstart then - local number = str2num (strsub (str, pstart, pend)) - if number then - return number, pend + 1 - end - end - pstart, pend = strfind (str, "^%a%w*", pos) - if pstart then - local name = strsub (str, pstart, pend) - if name == "true" then - return true, pend + 1 - elseif name == "false" then - return false, pend + 1 - elseif name == "null" then - return nullval, pend + 1 - end - end - return nil, pos, "no valid JSON value at " .. loc (str, pos) + return scaninvalid (str, pos) end end @@ -749,4 +810,3 @@ end return json - diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/dkjson-2.8/jsontest.lua new/dkjson-2.11/jsontest.lua --- old/dkjson-2.8/jsontest.lua 2024-06-17 21:36:32.000000000 +0200 +++ new/dkjson-2.11/jsontest.lua 2026-07-27 22:38:09.000000000 +0200 @@ -459,6 +459,13 @@ print ("decoding an empty array did not return a table") end + r, x = pcall(decode, "\xEF\xBB\xBF[]") + if not r then + print ("decoding an empty array with BOM raises an error:", x) + elseif type(x) ~= 'table' then + print ("decoding an empty array with BOM did not return a table") + end + r, x = pcall(decode, "[1e+2]") if not r then print ("decoding a number with exponential notation raises an error:", x) @@ -473,6 +480,22 @@ print ("decoding an array with two elements did not return the expected table") end + -- Duplicate keys are a complicated topic for JSON. + -- JavaScript allows duplicated keys, both in JavaScript code as well as in + -- parsed JSON. The second entry silently overwrites the first. + -- dkjson behaves in the same way. + -- This can cause security problems when two applications display + -- different views of the same file. + -- I am still considering how to address this. + r, x = pcall(decode, "{\"a\":1,\"a\":2}") + if not r then + print ("invalid object with duplicate keys raises an expected error:", x) + elseif type(x) ~= 'table' then + print ("invalid object with duplicate keys did not return a table") + else + print ("invalid object with duplicate keys returned:", x.a) + end + inlocale(function () local r, x = pcall(decode, "[0.5]") if not r then @@ -484,6 +507,9 @@ end end) + -- should not hang: + r, x = pcall(decode, "/a") + -- special tests for dkjson: if test_module == 'dkjson' then x = decode[=[ [{"x":0}] ]=] @@ -560,6 +586,33 @@ print("could not decode a string with multi line comments: "..tostring(m)) end end + + + do -- partial input and fuzzing + local testinput = [=[ +// ... +{/* ... +... */ "key" : "value", "key2" +:"value2", "array":[1, 2.45e2, 4]} +]=] + + local function parttest(len, ...) + local r, x = pcall(decode, testinput:sub(1, i) .. string.char(...)) + if not r then + print("fuzzing failed:", x, len, ...) + end + end + + for i = 0, #testinput do + parttest(i) + + for c1 = 0, 255 do + parttest(i, c1) + end + end + + end + end end @@ -729,7 +782,7 @@ end --- Copyright (C) 2011 David Heiko Kolf +-- Copyright (C) 2011 - 2025 David Heiko Kolf -- -- Permission is hereby granted, free of charge, to any person obtaining -- a copy of this software and associated documentation files (the diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/dkjson-2.8/readme.md new/dkjson-2.11/readme.md --- old/dkjson-2.8/readme.md 1970-01-01 01:00:00.000000000 +0100 +++ new/dkjson-2.11/readme.md 2026-07-27 22:38:09.000000000 +0200 @@ -0,0 +1,205 @@ +David Kolf's JSON module for Lua 5.1 - 5.5 +========================================== + +*Version 2.11* + +In the default configuration this module writes no global values, not even +the module table. Import it using + + json = require ("dkjson") + +In environments where `require` or a similiar function are not available +and you cannot receive the return value of the module, you can set the +option `register_global_module_table` to `true`. The module table will +then be saved in the global variable with the name given by the option +`global_module_name`. + +Exported functions and values: + +`json.encode (object [, state])` +-------------------------------- + +Create a string representing the object. `Object` can be a table, +a string, a number, a boolean, `nil`, `json.null` or any object with +a function `__tojson` in its metatable. A table can only use strings +and numbers as keys and its values have to be valid objects as +well. It raises an error for any invalid data types or reference +cycles. + +`state` is an optional table with the following fields: + + - `indent` + When `indent` (a boolean) is set, the created string will contain + newlines and indentations. Otherwise it will be one long line. + - `keyorder` + `keyorder` is an array to specify the ordering of keys in the + encoded output. If an object has keys which are not in this array + they are written after the sorted keys. + - `level` + This is the initial level of indentation used when `indent` is + set. For each level two spaces are added. When absent it is set + to 0. + - `buffer` + `buffer` is an array to store the strings for the result so they + can be concatenated at once. When it isn't given, the encode + function will create it temporary and will return the + concatenated result. + - `bufferlen` + When `bufferlen` is set, it has to be the index of the last + element of `buffer`. + - `tables` + `tables` is a set to detect reference cycles. It is created + temporary when absent. Every table that is currently processed + is used as key, the value is `true`. + - `exception` + When `exception` is given, it will be called whenever the encoder + cannot encode a given value. + The parameters are `reason`, `value`, `state` and `defaultmessage`. + `reason` is either `"reference cycle"`, `"custom encoder failed"` or + `"unsupported type"`. `value` is the original value that caused the + exception, `state` is this state table, `defaultmessage` is the message + of the error that would usually be raised. + You can either return `true` and add directly to the buffer or you can + return the string directly. To keep raising an error return `nil` and + the desired error message. + An example implementation for an exception function is given in + `json.encodeexception`. + +When `state.buffer` was set, the return value will be `true` on +success. Without `state.buffer` the return value will be a string. + +`json.decode (string [, position [, null]])` +-------------------------------------------- + +Decode `string` starting at `position` or at 1 if `position` was +omitted. + +`null` is an optional value to be returned for null values. The +default is `nil`, but you could set it to `json.null` or any other +value. + +The return values are the object or `nil`, the position of the next +character that doesn't belong to the object, and in case of errors +an error message. + +Two metatables are created. Every array or object that is decoded gets +a metatable with the `__jsontype` field set to either `array` or +`object`. If you want to provide your own metatables use the syntax + + json.decode (string, position, null, objectmeta, arraymeta) + +To prevent the assigning of metatables pass `nil`: + + json.decode (string, position, null, nil) + +`<metatable>.__jsonorder` +------------------------- + +`__jsonorder` can overwrite the `keyorder` for a specific table. + +`<metatable>.__jsontype` +------------------------ + +`__jsontype` can be either `"array"` or `"object"`. This value is only +checked for empty tables. (The default for empty tables is `"array"`). + +`<metatable>.__tojson (self, state)` +------------------------------------ + +You can provide your own `__tojson` function in a metatable. In this +function you can either add directly to the buffer and return true, +or you can return a string. On errors nil and a message should be +returned. + +`json.null` +----------- + +You can use this value for setting explicit `null` values. + +`json.version` +-------------- + +Set to `"dkjson 2.11"`. + +`json.quotestring (string)` +--------------------------- + +Quote a UTF-8 string and escape critical characters using JSON +escape sequences. This function is only necessary when you build +your own `__tojson` functions. + +`json.addnewline (state)` +------------------------- + +When `state.indent` is set, add a newline to `state.buffer` and spaces +according to `state.level`. + +`json.encodeexception (reason, value, state, defaultmessage)` +------------------------------------------------------------- + +This function can be used as value to the `exception` option. Instead of +raising an error this function encodes the error message as a string. This +can help to debug malformed input data. + + x = json.encode(value, { exception = json.encodeexception }) + +LPeg support +------------ + +When the local configuration variable `always_use_lpeg` is set, +this module tries to load LPeg to replace the `decode` function. The +speed increase is significant. You can get the LPeg module at + <http://www.inf.puc-rio.br/~roberto/lpeg/>. + +Without changing the module configuration you can get LPeg support by +calling the function `use_lpeg`: + +### `json.use_lpeg ()` + +Require the LPeg module and return a copy of the module table where the +`decode` function was replaced by a version that uses LPeg: + + json = require "dkjson".use_lpeg() + +Without the configuration to always use LPEG the original module table is +unchanged and still available by calls to + + json = require "dkjson" + +### `json.using_lpeg` + +This variable is set to `true` in the copy of the module table that uses +LPeg support. + +--------------------------------------------------------------------- + +Contact +------- + +You can contact the author by sending an e-mail to 'david' at the +domain 'dkolf.de'. + +--------------------------------------------------------------------- + +*Copyright (C) 2010-2026 David Heiko Kolf* + +Permission is hereby granted, free of charge, to any person obtaining +a copy of this software and associated documentation files (the +"Software"), to deal in the Software without restriction, including +without limitation the rights to use, copy, modify, merge, publish, +distribute, sublicense, and/or sell copies of the Software, and to +permit persons to whom the Software is furnished to do so, subject to +the following conditions: + +The above copyright notice and this permission notice shall be +included in all copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, +EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF +MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND +NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS +BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN +ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN +CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE +SOFTWARE. + diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/dkjson-2.8/readme.txt new/dkjson-2.11/readme.txt --- old/dkjson-2.8/readme.txt 2024-06-17 21:36:32.000000000 +0200 +++ new/dkjson-2.11/readme.txt 1970-01-01 01:00:00.000000000 +0100 @@ -1,205 +0,0 @@ -David Kolf's JSON module for Lua 5.1 - 5.4 -========================================== - -*Version 2.8* - -In the default configuration this module writes no global values, not even -the module table. Import it using - - json = require ("dkjson") - -In environments where `require` or a similiar function are not available -and you cannot receive the return value of the module, you can set the -option `register_global_module_table` to `true`. The module table will -then be saved in the global variable with the name given by the option -`global_module_name`. - -Exported functions and values: - -`json.encode (object [, state])` --------------------------------- - -Create a string representing the object. `Object` can be a table, -a string, a number, a boolean, `nil`, `json.null` or any object with -a function `__tojson` in its metatable. A table can only use strings -and numbers as keys and its values have to be valid objects as -well. It raises an error for any invalid data types or reference -cycles. - -`state` is an optional table with the following fields: - - - `indent` - When `indent` (a boolean) is set, the created string will contain - newlines and indentations. Otherwise it will be one long line. - - `keyorder` - `keyorder` is an array to specify the ordering of keys in the - encoded output. If an object has keys which are not in this array - they are written after the sorted keys. - - `level` - This is the initial level of indentation used when `indent` is - set. For each level two spaces are added. When absent it is set - to 0. - - `buffer` - `buffer` is an array to store the strings for the result so they - can be concatenated at once. When it isn't given, the encode - function will create it temporary and will return the - concatenated result. - - `bufferlen` - When `bufferlen` is set, it has to be the index of the last - element of `buffer`. - - `tables` - `tables` is a set to detect reference cycles. It is created - temporary when absent. Every table that is currently processed - is used as key, the value is `true`. - - `exception` - When `exception` is given, it will be called whenever the encoder - cannot encode a given value. - The parameters are `reason`, `value`, `state` and `defaultmessage`. - `reason` is either `"reference cycle"`, `"custom encoder failed"` or - `"unsupported type"`. `value` is the original value that caused the - exception, `state` is this state table, `defaultmessage` is the message - of the error that would usually be raised. - You can either return `true` and add directly to the buffer or you can - return the string directly. To keep raising an error return `nil` and - the desired error message. - An example implementation for an exception function is given in - `json.encodeexception`. - -When `state.buffer` was set, the return value will be `true` on -success. Without `state.buffer` the return value will be a string. - -`json.decode (string [, position [, null]])` --------------------------------------------- - -Decode `string` starting at `position` or at 1 if `position` was -omitted. - -`null` is an optional value to be returned for null values. The -default is `nil`, but you could set it to `json.null` or any other -value. - -The return values are the object or `nil`, the position of the next -character that doesn't belong to the object, and in case of errors -an error message. - -Two metatables are created. Every array or object that is decoded gets -a metatable with the `__jsontype` field set to either `array` or -`object`. If you want to provide your own metatables use the syntax - - json.decode (string, position, null, objectmeta, arraymeta) - -To prevent the assigning of metatables pass `nil`: - - json.decode (string, position, null, nil) - -`<metatable>.__jsonorder` -------------------------- - -`__jsonorder` can overwrite the `keyorder` for a specific table. - -`<metatable>.__jsontype` ------------------------- - -`__jsontype` can be either `"array"` or `"object"`. This value is only -checked for empty tables. (The default for empty tables is `"array"`). - -`<metatable>.__tojson (self, state)` ------------------------------------- - -You can provide your own `__tojson` function in a metatable. In this -function you can either add directly to the buffer and return true, -or you can return a string. On errors nil and a message should be -returned. - -`json.null` ------------ - -You can use this value for setting explicit `null` values. - -`json.version` --------------- - -Set to `"dkjson 2.8"`. - -`json.quotestring (string)` ---------------------------- - -Quote a UTF-8 string and escape critical characters using JSON -escape sequences. This function is only necessary when you build -your own `__tojson` functions. - -`json.addnewline (state)` -------------------------- - -When `state.indent` is set, add a newline to `state.buffer` and spaces -according to `state.level`. - -`json.encodeexception (reason, value, state, defaultmessage)` -------------------------------------------------------------- - -This function can be used as value to the `exception` option. Instead of -raising an error this function encodes the error message as a string. This -can help to debug malformed input data. - - x = json.encode(value, { exception = json.encodeexception }) - -LPeg support ------------- - -When the local configuration variable `always_use_lpeg` is set, -this module tries to load LPeg to replace the `decode` function. The -speed increase is significant. You can get the LPeg module at - <http://www.inf.puc-rio.br/~roberto/lpeg/>. - -Without changing the module configuration you can get LPeg support by -calling the function `use_lpeg`: - -### `json.use_lpeg ()` - -Require the LPeg module and return a copy of the module table where the -`decode` function was replaced by a version that uses LPeg: - - json = require "dkjson".use_lpeg() - -Without the configuration to always use LPEG the original module table is -unchanged and still available by calls to - - json = require "dkjson" - -### `json.using_lpeg` - -This variable is set to `true` in the copy of the module table that uses -LPeg support. - ---------------------------------------------------------------------- - -Contact -------- - -You can contact the author by sending an e-mail to 'david' at the -domain 'dkolf.de'. - ---------------------------------------------------------------------- - -*Copyright (C) 2010-2024 David Heiko Kolf* - -Permission is hereby granted, free of charge, to any person obtaining -a copy of this software and associated documentation files (the -"Software"), to deal in the Software without restriction, including -without limitation the rights to use, copy, modify, merge, publish, -distribute, sublicense, and/or sell copies of the Software, and to -permit persons to whom the Software is furnished to do so, subject to -the following conditions: - -The above copyright notice and this permission notice shall be -included in all copies or substantial portions of the Software. - -THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, -EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF -MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND -NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS -BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN -ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN -CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE -SOFTWARE. - diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/dkjson-2.8/versions.md new/dkjson-2.11/versions.md --- old/dkjson-2.8/versions.md 1970-01-01 01:00:00.000000000 +0100 +++ new/dkjson-2.11/versions.md 2026-07-27 22:38:09.000000000 +0200 @@ -0,0 +1,172 @@ +Version 2.11 (2026-07-27) +============ + +Changes since version 2.10: + * Fix another regression introduced to the pure-Lua decoder in 2.9: + Certain inputs can result in the decode function to raise an error instead + of returning nil. Depending on the circumstances this can also be used as + a denial-of-service attack. + * In response to those regressions, I have extended the test script with + some basic fuzzing tests. + +Version 2.10 (2026-05-13) +============ + +Changes since version 2.9: + * Fix regression in the pure-Lua decoder introduced in 2.9: + This is a security vulnerability enabling denial-of-service attacks + (unterminated loop) with a well-crafted (invalid JSON) input string. + +Version 2.9 (2026-04-29) +=========== + +Changes since version 2.8: + * Performance improvements for the pure-Lua decoder. + +Version 2.8 (2024-06-17) +=========== + +Changes since version 2.7: + * Fix handling of decoding errors when Lua is compiled with LUA_NOCVTN2S. + +Version 1.4 (2024-06-17) +=========== + +Changes since version 1.3: + * Fix handling of decoding errors when Lua is compiled with LUA_NOCVTN2S. + +Version 2.7 (2024-02-20) +=========== + +Changes since version 2.6: + + * Enable working with newer versions of LPeg where the "version" field + is no longer a function. + * Fix error messages when an encoding error happens in an ordered + dictionary. + +Version 2.6 (2021-12-19) +=========== + +Changes since version 2.5: + + * The decode function is no longer automatically replaced by the version + implemented using LPeg, but an LPeg-enabled copy of the module has to + be requested explicitly with the function use_lpeg. + This was changed to improve the predictability of the code and make + audits more reliable. + * The LPeg-version of the decode function now reports unterminated + strings, arrays and objects with the position where they started + rather than where parsing failed which was usually at the end of the + input string. This was already the behavior of the + pure-Lua-implementation. + * Fixed a bug where entries in a dictionary were not put in the desired + order when their value was the boolean false. + +Version 2.5 (2014-04-28) +=========== + +Changes since version 2.4: + + * Added customizable exception handling. + * Decode input that contains JavaScript comments. + +Version 2.4 (2013-09-28) +=========== + +Changes since version 2.3: + + * Fixed encoding and decoding of numbers in different numeric locales. + * Prevent using version 0.11 of LPeg (causes segmentation faults on + some systems). + +Version 1.3 (2013-09-28) +=========== + +Changes since version 1.2: + + * Fixed encoding and decoding of numbers in different numeric locales. + +Version 2.3 (2013-04-14) +=========== + +Changes since version 2.2: + + * Corrected the range of escaped characters. Among other characters + U+2029 was missing, which would cause trouble when parsed by a + JavaScript interpreter. + * Added options to register the module table in a global variable. + This is useful in environments where functions similar to require are + not available. + +Version 1.2 (2013-04-14) +=========== + +Changes since version 1.1: + + * Corrected the range of escaped characters. Among other characters + U+2029 was missing, which would cause trouble when parsed by a + JavaScript interpreter. + * Locations for error messages were off by one in the first line. + +Version 2.2 (2012-04-28) +=========== + +Changes since version 2.1: + + * __jsontype is only used for empty tables. + * It is possible to decode tables without assigning metatables. + * Locations for error messages were off by one in the first line. + * There is no LPeg version of json.quotestring anymore. + +Version 2.1 (2011-07-08) +=========== + +Changes since version 2.0: + + * Changed the documentation to Markdown format. + * LPeg is now parsing only a single value at a time to avoid running + out of Lua stack for big arrays and objects. + * Read __tojson, __jsontype and __jsonorder even from blocked metatables + through the debug module. + * Fixed decoding single numbers (only affected the non-LPeg mode). + * Corrected the range of escaped Unicode control characters. + +Version 1.1 (2011-07-08) +=========== + +Changes since version 1.0: + + * The values NaN/+Inf/-Inf are recognised and encoded as "null" like in + the original JavaScript implementation. + * Read __tojson even from blocked metatables through the debug module. + * Fixed decoding single numbers. + * Corrected the range of escaped Unicode control characters. + +Version 2.0 (2011-05-31) +=========== + +Changes since version 1.0: + + * Optional LPeg support. + * Invalid input data for encoding raises errors instead of returning nil + and the error message. (Invalid data for encoding is usually a + programming error. Raising an error removes the work of explicitly + checking the result). + * The metatable field __jsontype can control whether a Lua table is + encoded as a JSON array or object. (Mainly useful for empty tables). + * When decoding, two metatables are created. One is used to mark the arrays + while the other one is used for the objects. (The metatables are + created once for each decoding operation to make sandboxing possible. + However, you can specify your own metatables as arguments). + * There are no spaces added any longer when encoding. + * It is possible to explicitly sort keys for encoding by providing an array with key + names to the option "keyorder" or the metatable field __jsonorder. + * The values NaN/+Inf/-Inf are recognised and encoded as "null" like in + the original JavaScript implementation. + +Version 1.0 +=========== + +Initial version, released 2010-08-28. + diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/dkjson-2.8/versions.txt new/dkjson-2.11/versions.txt --- old/dkjson-2.8/versions.txt 2024-06-17 21:36:32.000000000 +0200 +++ new/dkjson-2.11/versions.txt 1970-01-01 01:00:00.000000000 +0100 @@ -1,147 +0,0 @@ -Version 2.8 (2024-06-17) -=========== - -Changes since version 2.7: - * Fix handling of decoding errors when Lua is compiled with LUA_NOCVTN2S. - -Version 1.4 (2024-06-17) -=========== - -Changes since version 1.3: - * Fix handling of decoding errors when Lua is compiled with LUA_NOCVTN2S. - -Version 2.7 (2024-02-20) -=========== - -Changes since version 2.6: - - * Enable working with newer versions of LPeg where the "version" field - is no longer a function. - * Fix error messages when an encoding error happens in an ordered - dictionary. - -Version 2.6 (2021-12-19) -=========== - -Changes since version 2.5: - - * The decode function is no longer automatically replaced by the version - implemented using LPeg, but an LPeg-enabled copy of the module has to - be requested explicitly with the function use_lpeg. - This was changed to improve the predictability of the code and make - audits more reliable. - * The LPeg-version of the decode function now reports unterminated - strings, arrays and objects with the position where they started - rather than where parsing failed which was usually at the end of the - input string. This was already the behavior of the - pure-Lua-implementation. - * Fixed a bug where entries in a dictionary were not put in the desired - order when their value was the boolean false. - -Version 2.5 (2014-04-28) -=========== - -Changes since version 2.4: - - * Added customizable exception handling. - * Decode input that contains JavaScript comments. - -Version 2.4 (2013-09-28) -=========== - -Changes since version 2.3: - - * Fixed encoding and decoding of numbers in different numeric locales. - * Prevent using version 0.11 of LPeg (causes segmentation faults on - some systems). - -Version 1.3 (2013-09-28) -=========== - -Changes since version 1.2: - - * Fixed encoding and decoding of numbers in different numeric locales. - -Version 2.3 (2013-04-14) -=========== - -Changes since version 2.2: - - * Corrected the range of escaped characters. Among other characters - U+2029 was missing, which would cause trouble when parsed by a - JavaScript interpreter. - * Added options to register the module table in a global variable. - This is useful in environments where functions similar to require are - not available. - -Version 1.2 (2013-04-14) -=========== - -Changes since version 1.1: - - * Corrected the range of escaped characters. Among other characters - U+2029 was missing, which would cause trouble when parsed by a - JavaScript interpreter. - * Locations for error messages were off by one in the first line. - -Version 2.2 (2012-04-28) -=========== - -Changes since version 2.1: - - * __jsontype is only used for empty tables. - * It is possible to decode tables without assigning metatables. - * Locations for error messages were off by one in the first line. - * There is no LPeg version of json.quotestring anymore. - -Version 2.1 (2011-07-08) -=========== - -Changes since version 2.0: - - * Changed the documentation to Markdown format. - * LPeg is now parsing only a single value at a time to avoid running - out of Lua stack for big arrays and objects. - * Read __tojson, __jsontype and __jsonorder even from blocked metatables - through the debug module. - * Fixed decoding single numbers (only affected the non-LPeg mode). - * Corrected the range of escaped Unicode control characters. - -Version 1.1 (2011-07-08) -=========== - -Changes since version 1.0: - - * The values NaN/+Inf/-Inf are recognised and encoded as "null" like in - the original JavaScript implementation. - * Read __tojson even from blocked metatables through the debug module. - * Fixed decoding single numbers. - * Corrected the range of escaped Unicode control characters. - -Version 2.0 (2011-05-31) -=========== - -Changes since version 1.0: - - * Optional LPeg support. - * Invalid input data for encoding raises errors instead of returning nil - and the error message. (Invalid data for encoding is usually a - programming error. Raising an error removes the work of explicitly - checking the result). - * The metatable field __jsontype can control whether a Lua table is - encoded as a JSON array or object. (Mainly useful for empty tables). - * When decoding, two metatables are created. One is used to mark the arrays - while the other one is used for the objects. (The metatables are - created once for each decoding operation to make sandboxing possible. - However, you can specify your own metatables as arguments). - * There are no spaces added any longer when encoding. - * It is possible to explicitly sort keys for encoding by providing an array with key - names to the option "keyorder" or the metatable field __jsonorder. - * The values NaN/+Inf/-Inf are recognised and encoded as "null" like in - the original JavaScript implementation. - -Version 1.0 -=========== - -Initial version, released 2010-08-28. -
