mirror of
https://github.com/nlohmann/json.git
synced 2026-09-26 22:05:59 +01:00
Niels Lohmann
cc472af13f
* Check the fuzzers' UBJSON/BJData round-trip invariants in the unit tests The strongest correctness checks for the UBJSON and BJData writers lived only in the OSS-Fuzz drivers: anything from_ubjson()/from_bjdata() returns must serialize with every option combination, parse back, and re-serialize stably. Those checks only run at OSS-Fuzz, so regressions surfaced days later as external reports - the same BJData assert pair was reported five times over three years, and #5494's harness change was followed by OSS-Fuzz 563659413 within a day. Add "UBJSON round-trip invariants" and "BJData round-trip invariants" test cases that run the drivers' checks on a fixed, deterministic corpus (tests/src/round_trip_corpus.hpp): integer and float boundaries, non-finite numbers, strings, binary values, optimized containers, deep nesting, the JData annotated-array matrix, and seeded random containers. They also check two properties the drivers do not: the first round trip preserves the value, and re-serializing reproduces the exact bytes. For BJData both exclude values containing a binary value, which is read back as an array of integers unless it was written as a Draft 3 optimized binary array; this carve-out is now documented in bjdata.md. Run against the headers before #5542, the BJData test fails, including on the shape from OSS-Fuzz 563659413. Also document how OSS-Fuzz reports are handled (reference them as "OSS-Fuzz: <id>", turn the reproducer into a unit test, keep drivers and unit tests in sync) in tests/fuzzing.md, and link it from the PR template and the quality assurance page. Signed-off-by: Niels Lohmann <mail@nlohmann.me> * Add the OSS-Fuzz reproducers for 474400817 and 474480402 as unit tests Following the convention added to tests/fuzzing.md, the reproducers of the two BJData fuzzer asserts tracked since January are now unit tests: - 474400817 (assert(false)): an empty object _ArraySize_ was written as the ND-array header length, which from_bjdata() could not read back. Fixed by #5455. - 474480402 (to_bjdata(j2, false, false) == vec2): a one-byte Draft 3 binary array is written in Draft 2 mode as a uint8 array and then re-serialized with the int8 marker. This is the documented exception to byte stability, not a library bug; OSS-Fuzz closed it after #5494 relaxed the harness to value stability. The test pins the exact bytes so the exception stays deliberate. The 563659413 reproducer is already a unit test (#5542). A comment also ties the existing UBJSON excessive-count test to the timeout OSS-Fuzz reported for that shape (testcase 6347769435193344). OSS-Fuzz: 474400817 OSS-Fuzz: 474480402 Signed-off-by: Niels Lohmann <mail@nlohmann.me> * Fix GCC -Weffc++ and -Wuseless-cast warnings in the round-trip corpus Initialize the atoms in the member initialization list, and drop the cast of the generator's result, which already is std::size_t on 64-bit Linux. Signed-off-by: Niels Lohmann <mail@nlohmann.me> --------- Signed-off-by: Niels Lohmann <mail@nlohmann.me>
17 KiB
17 KiB
Quality assurance
Ensuring quality is paramount for this project, particularly because numerous other projects depend on it. Each commit to the library undergoes rigorous checks against the following requirements, and any violations will result in a failed build.
C++ language compliance and compiler compatibility
!!! success "Requirement: Compiler support"
Any compiler with complete C++11 support can compile the library without warnings.
Note: C++20 modules support may hit compiler-specific issues not covered by the general compiler matrix below. See Modules for known issues and workarounds.
Note: Some modern features (like C++20 ranges or filesystem support) may be disabled on specific broken or incomplete toolchains even when standard feature-test macros indicate support. See JSON_HAS_RANGES and JSON_HAS_FILESYSTEM for details on known exclusions.
-
The library is compiled with 50+ different C++ compilers with different operating systems and platforms, including the oldest versions known to compile the library.
??? abstract "Compilers used in continuous integration"
| Compiler | Architecture | Operating System | CI | |----------------------------------------------|--------------|-----------------------------------|-----------| | AppleClang 15.0.0.15000040; Xcode 15.0.1 | arm64 | macOS 14.7.2 (Sonoma) | GitHub | | AppleClang 15.0.0.15000100; Xcode 15.1 | arm64 | macOS 14.7.2 (Sonoma) | GitHub | | AppleClang 15.0.0.15000100; Xcode 15.2 | arm64 | macOS 14.7.2 (Sonoma) | GitHub | | AppleClang 15.0.0.15000309; Xcode 15.3 | arm64 | macOS 14.7.2 (Sonoma) | GitHub | | AppleClang 15.0.0.15000309; Xcode 15.4 | arm64 | macOS 14.7.2 (Sonoma) | GitHub | | AppleClang 16.0.0.16000026; Xcode 16 | arm64 | macOS 15.2 (Sequoia) | GitHub | | AppleClang 16.0.0.16000026; Xcode 16.1 | arm64 | macOS 15.2 (Sequoia) | GitHub | | AppleClang 16.0.0.16000026; Xcode 16.2 | arm64 | macOS 15.2 (Sequoia) | GitHub | | AppleClang 17.0.0.17000013; Xcode 16.3 | arm64 | macOS 15.5 (Sequoia) | GitHub | | AppleClang 17.0.0.17000013; Xcode 16.4 | arm64 | macOS 15.5 (Sequoia) | GitHub | | AppleClang 17.0.0.17000319; Xcode 26.0.1 | arm64 | macOS 15.5 (Sequoia) | GitHub | | Clang 3.4.2 | x86_64 | Ubuntu 22.04.1 LTS | GitHub | | Clang 3.5.2 | x86_64 | Ubuntu 22.04.1 LTS | GitHub | | Clang 3.6.2 | x86_64 | Ubuntu 22.04.1 LTS | GitHub | | Clang 3.7.1 | x86_64 | Ubuntu 22.04.1 LTS | GitHub | | Clang 3.8.1 | x86_64 | Ubuntu 22.04.1 LTS | GitHub | | Clang 3.9.1 | x86_64 | Ubuntu 22.04.1 LTS | GitHub | | Clang 4.0.1 | x86_64 | Ubuntu 22.04.1 LTS | GitHub | | Clang 5.0.2 | x86_64 | Ubuntu 22.04.1 LTS | GitHub | | Clang 6.0.1 | x86_64 | Ubuntu 22.04.1 LTS | GitHub | | Clang 7.1.0 | x86_64 | Ubuntu 22.04.1 LTS | GitHub | | Clang 8.0.1 | x86_64 | Ubuntu 22.04.1 LTS | GitHub | | Clang 9.0.1 | x86_64 | Ubuntu 22.04.1 LTS | GitHub | | Clang 10.0.1 | x86_64 | Ubuntu 22.04.1 LTS | GitHub | | Clang 11.0.1 with GNU-like command-line | x86_64 | Windows Server 2022 (Build 20348) | GitHub | | Clang 11.1.0 | x86_64 | Ubuntu 22.04.1 LTS | GitHub | | Clang 12.0.1 with GNU-like command-line | x86_64 | Windows Server 2022 (Build 20348) | GitHub | | Clang 12.0.1 | x86_64 | Ubuntu 22.04.1 LTS | GitHub | | Clang 13.0.1 with GNU-like command-line | x86_64 | Windows Server 2022 (Build 20348) | GitHub | | Clang 13.0.1 | x86_64 | Ubuntu 22.04.1 LTS | GitHub | | Clang 14.0.6 | x86_64 | Ubuntu 22.04.1 LTS | GitHub | | Clang 14.0.6 with GNU-like command-line | x86_64 | Windows Server 2022 (Build 20348) | GitHub | | Clang 15.0.7 | x86_64 | Ubuntu 22.04.1 LTS | GitHub | | Clang 15.0.7 with GNU-like command-line | x86_64 | Windows Server 2022 (Build 20348) | GitHub | | Clang 16.0.6 | x86_64 | Ubuntu 22.04.1 LTS | GitHub | | Clang 16.0.6 with GNU-like command-line | x86_64 | Windows Server 2022 (Build 20348) | GitHub | | Clang 17.0.6 | x86_64 | Ubuntu 22.04.1 LTS | GitHub | | Clang 18.1.8 | x86_64 | Ubuntu 22.04.1 LTS | GitHub | | Clang 18.1.8 with GNU-like command-line | x86_64 | Windows Server 2022 (Build 20348) | GitHub | | Clang 19.1.5 with MSVC-like command-line | x86_64 | Windows Server 2022 (Build 20348) | GitHub | | Clang 19.1.7 | x86_64 | Ubuntu 22.04.1 LTS | GitHub | | Clang 19.1.7 with GNU-like command-line | x86_64 | Windows Server 2022 (Build 20348) | GitHub | | Clang 20.1.1 | x86_64 | Ubuntu 22.04.1 LTS | GitHub | | Clang 20.1.8 with GNU-like command-line | x86_64 | Windows Server 2022 (Build 20348) | GitHub | | Clang 21.1.8 | x86_64 | Ubuntu 22.04.1 LTS | GitHub | | Clang 22.1.8 | x86_64 | Ubuntu 22.04.1 LTS | GitHub | | CUDA 11.8.0 (nvcc) | x86_64 | Ubuntu 22.04 LTS | GitHub | | CUDA 12.1.1 (nvcc) | x86_64 | Ubuntu 22.04 LTS | GitHub | | CUDA 12.6.3 (nvcc) | x86_64 | Ubuntu 22.04 LTS | GitHub | | Emscripten 4.0.6 | x86_64 | Ubuntu 22.04.1 LTS | GitHub | | GNU 4.8.5 | x86_64 | Ubuntu 20.04 LTS | GitHub | | GNU 4.9.3 | x86_64 | Ubuntu 20.04 LTS | GitHub | | GNU 5.5.0 | x86_64 | Ubuntu 20.04 LTS | GitHub | | GNU 6.4.0 | x86_64 | Ubuntu 20.04 LTS | GitHub | | GNU 7.5.0 | x86_64 | Ubuntu 22.04.1 LTS | GitHub | | GNU 8.5.0 | x86_64 | Ubuntu 22.04.1 LTS | GitHub | | GNU 9.3.0 | x86_64 | Ubuntu 22.04.1 LTS | GitHub | | GNU 9.4.0 | x86_64 | Ubuntu 22.04.1 LTS | GitHub | | GNU 9.5.0 | x86_64 | Ubuntu 22.04.1 LTS | GitHub | | GNU 10.5.0 | x86_64 | Ubuntu 22.04.1 LTS | GitHub | | GNU 11.4.0 | x86_64 | Ubuntu 22.04.1 LTS | GitHub | | GNU 11.5.0 | x86_64 | Ubuntu 22.04.1 LTS | GitHub | | GNU 12.2.0 (MinGW-W64 i686-ucrt-posix-dwarf) | x86_64 | Windows Server 2022 (Build 20348) | GitHub | | GNU 12.2.0 (MinGW-W64 x86_64-ucrt-posix-seh) | x86_64 | Windows Server 2022 (Build 20348) | GitHub | | GNU 12.4.0 | x86_64 | Ubuntu 22.04.1 LTS | GitHub | | GNU 13.3.0 | x86_64 | Ubuntu 22.04.1 LTS | GitHub | | GNU 14.2.0 | x86_64 | Ubuntu 22.04.1 LTS | GitHub | | GNU 15.1.0 | x86_64 | Ubuntu 22.04.1 LTS | GitHub | | GNU 16.1.0 | x86_64 | Ubuntu 22.04.1 LTS | GitHub | | GNU 16.1.0 | arm64 | Linux 6.1.100 | Cirrus CI | | icpc (ICC) 2021.10.0 20230609 | x86_64 | Ubuntu 22.04 LTS | GitHub | | icpx (Intel oneAPI DPC++/C++) 2025.3.2 | x86_64 | Ubuntu 24.04 LTS | GitHub | | nvc++ (NVIDIA HPC SDK) 25.5-0 | x86_64 | Ubuntu 22.04 LTS | GitHub | | MSVC 19.0.24241.7 | x86 | Windows 8.1 | AppVeyor | | MSVC 19.16.27035.0 | x86 | Windows-10 (Build 14393) | AppVeyor | | MSVC 19.29.30157.0 | x86 | Windows-10 (Build 17763) | AppVeyor | | MSVC 19.44.35207.0 | arm64 | Windows 11 (Build 26200) | GitHub | | MSVC 19.44.35214.0 | x86 | Windows Server 2022 (Build 20348) | GitHub | | MSVC 19.44.35214.0 | x86_64 | Windows Server 2022 (Build 20348) | GitHub | | MSVC 19.51.36231.0 | x86 | Windows Server 2025 (Build 26100) | GitHub | | MSVC 19.51.36231.0 | x86_64 | Windows Server 2025 (Build 26100) | GitHub | -
The library is compiled with all C++ language revisions (C++11, C++14, C++17, C++20, C++23, and C++26) to detect and fix language deprecations early.
-
The library is checked for compiler warnings:
-
On Clang,
-Weverythingis used with 8 exceptions.??? abstract "Clang warnings"
```cmake --8<-- "../../../cmake/clang_flags.cmake" ``` -
On GCC, 300+ warnings are enabled with 8 exceptions.
??? abstract "GCC warnings"
```cmake --8<-- "../../../cmake/gcc_flags.cmake" ```
-
C++ standard library compliance
!!! success "Requirement: No prerequisites"
The library has no prerequisites other than the Standard Template Library (STL).
- The library is compiled and tested with both libc++ and libstdc++ to detect subtle differences or incompatibilities.
- The code checked with Include What You Use (IWYU) that all required standard headers are included.
- On Windows, the library is compiled with
<Windows.h>being included to detect and avoid common bugs. - The library is compiled with exceptions disabled to support alternative means of error handling.
Stable public API
!!! success "Requirement: Stable public API"
Any change to the library does not break the public API.
- All public API functions are tested with a variety of arguments.
- The library is compiled and tested with different template arguments for number, string, array, and object types.
- Unit tests cover all lines of the code base.
- Every exception of the library is thrown in the test suite, and the error messages and exception ids are checked.
!!! success "Requirement: Complete documentation"
The public API is extensively documented.
- Every public API function has a dedicated page in the API reference documentation with a self-contained code example.
- All examples in the documentation are tested, and changes in their output are treated as an error.
Robust input processing
!!! success "Requirement: Standards compliance"
The library is compliant to JSON as defined in [RFC 8259](https://datatracker.ietf.org/doc/html/rfc8259).
- The lexer is tested with all valid Unicode code points and all prefixes of all invalid Unicode code points.
- The parser is tested against extensive correctness suites for JSON compliance.
- In addition, the library is continuously fuzz-tested at OSS-Fuzz where the library is checked against billions of inputs.
- Every crash reported by OSS-Fuzz is fixed together with a unit test that reproduces it, and the fix references the OSS-Fuzz issue. The round-trip checks of the fuzzer drivers are also part of the unit tests. See the fuzz testing documentation.
Static analysis
!!! success "Requirement: State-of-the-art code analysis"
The code is checked with state-of-the-art static code analysis tools.
-
The code is checked with the latest Clang-Tidy.
??? abstract "Clang-Tidy configuration (.clang-tidy)"
```ini --8<-- "../../../.clang-tidy" ``` -
The code is checked with the latest Cppcheck with all warnings enabled.
-
The code is checked with the latest Clang Static Analyzer with 89 enabled rules.
-
The code is checked with Infer.
-
The code is checked with Codacy.
Dynamic analysis
!!! success "Requirement: Correctness"
The library is checked for memory correctness and absence of undefined behavior.
- The test suite is executed with enabled runtime assertions to check invariants and preconditions of functions to detect undefined behavior.
- The test suite is executed with Valgrind (Memcheck) to detect memory leaks.
- The test suite is executed with Sanitizers (address sanitizer, undefined behavior sanitizer, integer overflow detection, nullability violations).
Style check
!!! success "Requirement: Common code style"
A common code style is used throughout all code files of the library.
-
The code is formatted with Artistic Style (astyle) against a style configuration that is also enforced in the CI.
??? abstract "Astyle configuration (tools/astyle/.astylerc)"
```ini --8<-- "../../../tools/astyle/.astylerc" ``` -
The code style is checked with cpplint with 61 enabled rules.
Simple integration
!!! success "Requirement: Single header"
The library can be used by adding a single header to a C++ project.
- An amalgamation script is used to check if the source code is exposed as a self-contained single-header file.
- The test suite is checked against the amalgamated source file as well as the individual source file.
!!! success "Requirement: CMake as primary development tool"
All library functions are exposed and usable by CMake.
- All library options are exposed as CMake options and tested.
- The library is tested against relevant CMake versions:
- CMake 3.5 (the earliest supported)
- CMake 3.31.6 (the latest 3.x release)
- CMake 4.0.0 (a very recent release)