You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: aspnetcore/web-api/jsonpatch.md
+4-4Lines changed: 4 additions & 4 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -41,7 +41,7 @@ The following benchmarks compare the performance of the new `System.Text.Json` i
41
41
These benchmarks highlight significant performance gains and reduced memory usage with the new implementation.
42
42
43
43
> [!NOTE]
44
-
> The new implementation of `JsonPatch` based on `System.Text.Json` serialization isn't a drop-in replacement for the legacy `Newtonsoft.Json`-based implementation. It doesn't support dynamic types, for example [`ExpandoObject`](/dotnet/api/system.dynamic.expandoobject).
44
+
> The new implementation of <xref:Microsoft.AspNetCore.JsonPatch> based on <xref:System.Text.Json?displayProperty=fullName> serialization isn't a drop-in replacement for the legacy `Newtonsoft.Json`-based implementation. It doesn't support dynamic types, for example <xref:System.Dynamic.ExpandoObject>.
45
45
46
46
> [!IMPORTANT]
47
47
> The JSON Patch standard has ***inherent security risks***. Since these risks are inherent to the JSON Patch standard, the new implementation ***doesn't attempt to mitigate inherent security risks***. It's the responsibility of the developer to ensure that the JSON Patch document is safe to apply to the target object. For more information, see the [Mitigating Security Risks](#mitigating-security-risks) section.
@@ -315,7 +315,7 @@ The previous example results in the following output of the updated object:
315
315
316
316
The `ApplyTo` method generally follows the conventions and options of `System.Text.Json` for processing the `JsonPatchDocument`, including the behavior controlled by the following options:
317
317
318
-
*`NumberHandling`: Whether numeric properties can be read from strings.
318
+
*`NumberHandling`: Whether numeric properties are read from strings.
319
319
*`PropertyNameCaseInsensitive`: Whether property names are case-sensitive.
320
320
321
321
Key differences between `System.Text.Json` and the new `JsonPatchDocument<T>` implementation:
@@ -397,7 +397,7 @@ to the test value 'Jane'.
397
397
When using the `Microsoft.AspNetCore.JsonPatch.SystemTextJson` package, it's critical to understand and mitigate potential security risks. The following sections outline the identified security risks associated with JSON Patch and provide recommended mitigations to ensure secure usage of the package.
398
398
399
399
> [!IMPORTANT]
400
-
> ***This is not an exhaustive list of threats.***app developers must conduct their own threat model reviews to determine an app-specific comprehensive list and come up with appropriate mitigations as needed. For example, apps which expose collections to patch operations should consider the potential for algorithmic complexity attacks if those operations insert or remove elements at the beginning of the collection.
400
+
> ***This is not an exhaustive list of threats.***App developers must conduct their own threat model reviews to determine an app-specific comprehensive list and come up with appropriate mitigations as needed. For example, apps which expose collections to patch operations should consider the potential for algorithmic complexity attacks if those operations insert or remove elements at the beginning of the collection.
401
401
402
402
By running comprehensive threat models for their own apps and addressing identified threats while following the recommended mitigations below, consumers of these packages can integrate JSON Patch functionality into their apps while minimizing security risks.
403
403
@@ -413,7 +413,7 @@ Consumers of these packages can integrate JSON Patch functionality into their ap
413
413
***Impact**: Potential Out-Of-Memory (OOM) conditions, causing service disruptions.
414
414
***Mitigation**:
415
415
* Validate incoming JSON Patch documents for size and structure before calling `ApplyTo`.
416
-
* The validation needs to be app specific, but an example validation can look similar to the following:
416
+
* The validation must be app specific, but an example validation can look similar to the following:
0 commit comments