CVE-2022-32511

@@ -6,6 +6,6 @@
 require 'json'
 
 expression = ARGV[0]
-json = JSON.load(STDIN.read)
+json = JSON.parse(STDIN.read)
 
 $stdout.puts(JSON.dump(JMESPath.search(expression, json)))

@@ -1,10 +1,12 @@
-1.6.0 (2022-02-14)
+Unreleased Changes
 ------------------
 
+* Issue - Use `JSON.parse` instead of `JSON.load`.
+
 1.6.0 (2022-02-14)
 ------------------
 
-* Feature - Add support for string comparisions.
+* Feature - Add support for string comparisons.
 
 1.5.0 (2022-01-10)
 ------------------
@@ -230,4 +232,3 @@
 ------------------
 
 * Passing all of the JMESPath compliance tests.
-

@@ -298,12 +298,12 @@ def inside(chars, delim, type)
     # Certain versions of Ruby and of the pure_json gem not support loading
     # scalar JSON values, such a numbers, booleans, strings, etc. These
     # simple values must be first wrapped inside a JSON object before calling
-    # `JSON.load`.
+    # `JSON.parse`.
     #
     #    # works in most JSON versions, raises in some versions
-    #    JSON.load("true")
-    #    JSON.load("123")
-    #    JSON.load("\"abc\"")
+    #    JSON.parse("true")
+    #    JSON.parse("123")
+    #    JSON.parse("\"abc\"")
     #
     # This is an known issue for:
     #
@@ -317,12 +317,12 @@ def inside(chars, delim, type)
     # causes issues in environments that cannot compile the gem. We previously
     # had a direct dependency on `json_pure`, but this broke with the v2 update.
     #
-    # This method allows us to detect how the `JSON.load` behaves so we know
+    # This method allows us to detect how the `JSON.parse` behaves so we know
     # if we have to wrap scalar JSON values to parse them or not.
     # @api private
     def self.requires_wrapping?
       begin
-        JSON.load('false')
+        JSON.parse('false')
       rescue JSON::ParserError
         true
       end
@@ -332,12 +332,12 @@ def self.requires_wrapping?
       def parse_json(token, quoted = false)
         begin
           if quoted
-            token.value = JSON.load("{\"value\":#{token.value}}")['value']
+            token.value = JSON.parse("{\"value\":#{token.value}}")['value']
           else
             begin
-              token.value = JSON.load("{\"value\":#{token.value}}")['value']
+              token.value = JSON.parse("{\"value\":#{token.value}}")['value']
             rescue
-              token.value = JSON.load(sprintf('{"value":"%s"}', token.value.lstrip))['value']
+              token.value = JSON.parse(sprintf('{"value":"%s"}', token.value.lstrip))['value']
             end
           end
         rescue JSON::ParserError
@@ -349,9 +349,9 @@ def parse_json(token, quoted = false)
       def parse_json(token, quoted = false)
         begin
           if quoted
-            token.value = JSON.load(token.value)
+            token.value = JSON.parse(token.value)
           else
-            token.value = JSON.load(token.value) rescue JSON.load(sprintf('"%s"', token.value.lstrip))
+            token.value = JSON.parse(token.value) rescue JSON.parse(sprintf('"%s"', token.value.lstrip))
           end
         rescue JSON::ParserError
           token.type = T_UNKNOWN

@@ -26,15 +26,15 @@ def search(expression, data, runtime_options = {})
       data = case data
         when Hash, Struct then data # check for most common case first
         when Pathname then load_json(data)
-        when IO, StringIO then JSON.load(data.read)
+        when IO, StringIO then JSON.parse(data.read)
         else data
         end
       Runtime.new(runtime_options).search(expression, data)
     end
 
     # @api private
     def load_json(path)
-      JSON.load(File.open(path, 'r', encoding: 'UTF-8') { |f| f.read })
+      JSON.parse(File.open(path, 'r', encoding: 'UTF-8') { |f| f.read })
     end
 
   end