From f517de4bd1061b8f6e44a90a5c2364d95db89530 Mon Sep 17 00:00:00 2001
From: Matt Muller <mamuller@amazon.com>
Date: Mon, 7 Mar 2022 09:30:32 -0800
Subject: [PATCH] Use JSON.parse instead of JSON.load

---
 CHANGELOG.md          |  7 ++++---
 bin/jmespath.rb       |  2 +-
 lib/jmespath.rb       |  4 ++--
 lib/jmespath/lexer.rb | 22 +++++++++++-----------
 4 files changed, 18 insertions(+), 17 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 685db01..18d6cc8 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,10 +1,12 @@
-1.6.0 (2022-02-14)
+Unreleased Changes
 ------------------
 
+* Issue - Use `JSON.parse` instead of `JSON.load`.
+
 1.6.0 (2022-02-14)
 ------------------
 
-* Feature - Add support for string comparisions.
+* Feature - Add support for string comparisons.
 
 1.5.0 (2022-01-10)
 ------------------
@@ -230,4 +232,3 @@
 ------------------
 
 * Passing all of the JMESPath compliance tests.
-
diff --git a/bin/jmespath.rb b/bin/jmespath.rb
index 8180980..0d5ecee 100755
--- a/bin/jmespath.rb
+++ b/bin/jmespath.rb
@@ -6,6 +6,6 @@
 require 'json'
 
 expression = ARGV[0]
-json = JSON.load(STDIN.read)
+json = JSON.parse(STDIN.read)
 
 $stdout.puts(JSON.dump(JMESPath.search(expression, json)))
diff --git a/lib/jmespath.rb b/lib/jmespath.rb
index a92b782..aa54a1e 100644
--- a/lib/jmespath.rb
+++ b/lib/jmespath.rb
@@ -26,7 +26,7 @@ def search(expression, data, runtime_options = {})
       data = case data
         when Hash, Struct then data # check for most common case first
         when Pathname then load_json(data)
-        when IO, StringIO then JSON.load(data.read)
+        when IO, StringIO then JSON.parse(data.read)
         else data
         end
       Runtime.new(runtime_options).search(expression, data)
@@ -34,7 +34,7 @@ def search(expression, data, runtime_options = {})
 
     # @api private
     def load_json(path)
-      JSON.load(File.open(path, 'r', encoding: 'UTF-8') { |f| f.read })
+      JSON.parse(File.open(path, 'r', encoding: 'UTF-8') { |f| f.read })
     end
 
   end
diff --git a/lib/jmespath/lexer.rb b/lib/jmespath/lexer.rb
index 4962567..f12097b 100644
--- a/lib/jmespath/lexer.rb
+++ b/lib/jmespath/lexer.rb
@@ -298,12 +298,12 @@ def inside(chars, delim, type)
     # Certain versions of Ruby and of the pure_json gem not support loading
     # scalar JSON values, such a numbers, booleans, strings, etc. These
     # simple values must be first wrapped inside a JSON object before calling
-    # `JSON.load`.
+    # `JSON.parse`.
     #
     #    # works in most JSON versions, raises in some versions
-    #    JSON.load("true")
-    #    JSON.load("123")
-    #    JSON.load("\"abc\"")
+    #    JSON.parse("true")
+    #    JSON.parse("123")
+    #    JSON.parse("\"abc\"")
     #
     # This is an known issue for:
     #
@@ -317,12 +317,12 @@ def inside(chars, delim, type)
     # causes issues in environments that cannot compile the gem. We previously
     # had a direct dependency on `json_pure`, but this broke with the v2 update.
     #
-    # This method allows us to detect how the `JSON.load` behaves so we know
+    # This method allows us to detect how the `JSON.parse` behaves so we know
     # if we have to wrap scalar JSON values to parse them or not.
     # @api private
     def self.requires_wrapping?
       begin
-        JSON.load('false')
+        JSON.parse('false')
       rescue JSON::ParserError
         true
       end
@@ -332,12 +332,12 @@ def self.requires_wrapping?
       def parse_json(token, quoted = false)
         begin
           if quoted
-            token.value = JSON.load("{\"value\":#{token.value}}")['value']
+            token.value = JSON.parse("{\"value\":#{token.value}}")['value']
           else
             begin
-              token.value = JSON.load("{\"value\":#{token.value}}")['value']
+              token.value = JSON.parse("{\"value\":#{token.value}}")['value']
             rescue
-              token.value = JSON.load(sprintf('{"value":"%s"}', token.value.lstrip))['value']
+              token.value = JSON.parse(sprintf('{"value":"%s"}', token.value.lstrip))['value']
             end
           end
         rescue JSON::ParserError
@@ -349,9 +349,9 @@ def parse_json(token, quoted = false)
       def parse_json(token, quoted = false)
         begin
           if quoted
-            token.value = JSON.load(token.value)
+            token.value = JSON.parse(token.value)
           else
-            token.value = JSON.load(token.value) rescue JSON.load(sprintf('"%s"', token.value.lstrip))
+            token.value = JSON.parse(token.value) rescue JSON.parse(sprintf('"%s"', token.value.lstrip))
           end
         rescue JSON::ParserError
           token.type = T_UNKNOWN