Skip to content

Commit c0ea3dd

Browse files
committed
Small edits
1 parent 9d7a34f commit c0ea3dd

File tree

1 file changed

+4
-4
lines changed

1 file changed

+4
-4
lines changed

aspnetcore/web-api/jsonpatch.md

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -41,7 +41,7 @@ The following benchmarks compare the performance of the new `System.Text.Json` i
4141
These benchmarks highlight significant performance gains and reduced memory usage with the new implementation.
4242

4343
> [!NOTE]
44-
> The new implementation of `JsonPatch` based on `System.Text.Json` serialization isn't a drop-in replacement for the legacy `Newtonsoft.Json`-based implementation. It doesn't support dynamic types, for example [`ExpandoObject`](/dotnet/api/system.dynamic.expandoobject).
44+
> The new implementation of <xref:Microsoft.AspNetCore.JsonPatch> based on <xref:System.Text.Json?displayProperty=fullName> serialization isn't a drop-in replacement for the legacy `Newtonsoft.Json`-based implementation. It doesn't support dynamic types, for example <xref:System.Dynamic.ExpandoObject>.
4545
4646
> [!IMPORTANT]
4747
> The JSON Patch standard has ***inherent security risks***. Since these risks are inherent to the JSON Patch standard, the new implementation ***doesn't attempt to mitigate inherent security risks***. It's the responsibility of the developer to ensure that the JSON Patch document is safe to apply to the target object. For more information, see the [Mitigating Security Risks](#mitigating-security-risks) section.
@@ -315,7 +315,7 @@ The previous example results in the following output of the updated object:
315315

316316
The `ApplyTo` method generally follows the conventions and options of `System.Text.Json` for processing the `JsonPatchDocument`, including the behavior controlled by the following options:
317317

318-
* `NumberHandling`: Whether numeric properties can be read from strings.
318+
* `NumberHandling`: Whether numeric properties are read from strings.
319319
* `PropertyNameCaseInsensitive`: Whether property names are case-sensitive.
320320

321321
Key differences between `System.Text.Json` and the new `JsonPatchDocument<T>` implementation:
@@ -397,7 +397,7 @@ to the test value 'Jane'.
397397
When using the `Microsoft.AspNetCore.JsonPatch.SystemTextJson` package, it's critical to understand and mitigate potential security risks. The following sections outline the identified security risks associated with JSON Patch and provide recommended mitigations to ensure secure usage of the package.
398398

399399
> [!IMPORTANT]
400-
> ***This is not an exhaustive list of threats.*** app developers must conduct their own threat model reviews to determine an app-specific comprehensive list and come up with appropriate mitigations as needed. For example, apps which expose collections to patch operations should consider the potential for algorithmic complexity attacks if those operations insert or remove elements at the beginning of the collection.
400+
> ***This is not an exhaustive list of threats.*** App developers must conduct their own threat model reviews to determine an app-specific comprehensive list and come up with appropriate mitigations as needed. For example, apps which expose collections to patch operations should consider the potential for algorithmic complexity attacks if those operations insert or remove elements at the beginning of the collection.
401401
402402
By running comprehensive threat models for their own apps and addressing identified threats while following the recommended mitigations below, consumers of these packages can integrate JSON Patch functionality into their apps while minimizing security risks.
403403

@@ -413,7 +413,7 @@ Consumers of these packages can integrate JSON Patch functionality into their ap
413413
* **Impact**: Potential Out-Of-Memory (OOM) conditions, causing service disruptions.
414414
* **Mitigation**:
415415
* Validate incoming JSON Patch documents for size and structure before calling `ApplyTo`.
416-
* The validation needs to be app specific, but an example validation can look similar to the following:
416+
* The validation must be app specific, but an example validation can look similar to the following:
417417

418418
```csharp
419419
public void Validate(JsonPatchDocument<T> patch)

0 commit comments

Comments
 (0)