From b1f578cb0d5a0c43748a42396af9c39e242c0157 Mon Sep 17 00:00:00 2001
From: Levi Broderick <levib@microsoft.com>
Date: Thu, 27 Mar 2025 19:07:21 -0700
Subject: [PATCH] Rename rapidjson helper functions

---
 src/native/corehost/comhost/clsidmap.cpp           |  4 ++--
 src/native/corehost/fxr/sdk_resolver.cpp           |  2 +-
 .../fxr/standalone/hostpolicy_resolver.cpp         |  2 +-
 src/native/corehost/hostpolicy/deps_format.cpp     |  4 ++--
 src/native/corehost/json_parser.cpp                | 14 ++++++++++----
 src/native/corehost/json_parser.h                  |  4 ++--
 src/native/corehost/runtime_config.cpp             |  4 ++--
 7 files changed, 20 insertions(+), 14 deletions(-)

diff --git a/src/native/corehost/comhost/clsidmap.cpp b/src/native/corehost/comhost/clsidmap.cpp
index 001649765f662e..281dc1cef3d4ef 100644
--- a/src/native/corehost/comhost/clsidmap.cpp
+++ b/src/native/corehost/comhost/clsidmap.cpp
@@ -100,7 +100,7 @@ namespace
             throw HResultException{ E_UNEXPECTED }; // This should never happen in Windows 7+
 
         json_parser_t json;
-        if (!json.parse_raw_data(reinterpret_cast<char*>(data), size, _X("<embedded .clsidmap>")))
+        if (!json.parse_fully_trusted_raw_data(reinterpret_cast<char*>(data), size, _X("<embedded .clsidmap>")))
         {
             trace::error(_X("Embedded .clsidmap format is invalid"));
             throw HResultException{ StatusCode::InvalidConfigFile };
@@ -178,7 +178,7 @@ namespace
             return {};
 
         json_parser_t json;
-        if (!json.parse_file(map_file_name))
+        if (!json.parse_fully_trusted_file(map_file_name))
         {
             trace::error(_X("File .clsidmap format is invalid"));
             throw HResultException{ StatusCode::InvalidConfigFile };
diff --git a/src/native/corehost/fxr/sdk_resolver.cpp b/src/native/corehost/fxr/sdk_resolver.cpp
index dd54f2e7932459..7a365001b1c796 100644
--- a/src/native/corehost/fxr/sdk_resolver.cpp
+++ b/src/native/corehost/fxr/sdk_resolver.cpp
@@ -325,7 +325,7 @@ bool sdk_resolver::parse_global_file(pal::string_t global_file_path)
     // After we're done parsing `global_file_path`, none of its contents will be referenced
     // from the data private to json_parser_t; it's safe to declare it on the stack.
     json_parser_t json;
-    if (!json.parse_file(global_file_path))
+    if (!json.parse_fully_trusted_file(global_file_path))
     {
         return false;
     }
diff --git a/src/native/corehost/fxr/standalone/hostpolicy_resolver.cpp b/src/native/corehost/fxr/standalone/hostpolicy_resolver.cpp
index 4e75400a04a81b..8a047a145ef9f8 100644
--- a/src/native/corehost/fxr/standalone/hostpolicy_resolver.cpp
+++ b/src/native/corehost/fxr/standalone/hostpolicy_resolver.cpp
@@ -29,7 +29,7 @@ namespace
 
         pal::string_t retval;
         json_parser_t json;
-        if (!json.parse_file(deps_json))
+        if (!json.parse_fully_trusted_file(deps_json))
         {
             return retval;
         }
diff --git a/src/native/corehost/hostpolicy/deps_format.cpp b/src/native/corehost/hostpolicy/deps_format.cpp
index 7a58f12bb067f2..a882199819a757 100644
--- a/src/native/corehost/hostpolicy/deps_format.cpp
+++ b/src/native/corehost/hostpolicy/deps_format.cpp
@@ -94,7 +94,7 @@ deps_json_t::rid_fallback_graph_t deps_json_t::get_rid_fallback_graph(const pal:
         return rid_fallback_graph;
 
     json_parser_t json;
-    if (!json.parse_file(deps_path_local))
+    if (!json.parse_fully_trusted_file(deps_path_local))
         return rid_fallback_graph;
 
     populate_rid_fallback_graph(json.document(), rid_fallback_graph);
@@ -586,7 +586,7 @@ void deps_json_t::load(bool is_framework_dependent, std::function<void(const jso
     }
 
     json_parser_t json;
-    if (!json.parse_file(m_deps_file))
+    if (!json.parse_fully_trusted_file(m_deps_file))
         return;
 
     m_valid = true;
diff --git a/src/native/corehost/json_parser.cpp b/src/native/corehost/json_parser.cpp
index 748f566e55b414..9e41c5556e509b 100644
--- a/src/native/corehost/json_parser.cpp
+++ b/src/native/corehost/json_parser.cpp
@@ -44,8 +44,11 @@ void get_line_column_from_offset(const char* data, uint64_t size, size_t offset,
 
 } // empty namespace
 
-bool json_parser_t::parse_raw_data(char* data, int64_t size, const pal::string_t& context)
+bool json_parser_t::parse_fully_trusted_raw_data(char* data, int64_t size, const pal::string_t& context)
 {
+    // This code assumes that the provided data is fully trusted; that is, that no portion
+    // of it has been provided by a hostile agent.
+
     assert(data != nullptr);
 
     constexpr auto flags = rapidjson::ParseFlag::kParseStopWhenDoneFlag | rapidjson::ParseFlag::kParseCommentsFlag;
@@ -81,10 +84,13 @@ bool json_parser_t::parse_raw_data(char* data, int64_t size, const pal::string_t
     return true;
 }
 
-bool json_parser_t::parse_file(const pal::string_t& path)
+bool json_parser_t::parse_fully_trusted_file(const pal::string_t& path)
 {
     // This code assumes that the caller has checked that the file `path` exists
-    // either within the bundle, or as a real file on disk.
+    // either within the bundle, or as a real file on disk. It also assumes
+    // that the contents of the target file are fully trusted; that is, that no
+    // portion of its contents has been provided by a hostile agent.
+
     assert(m_data == nullptr);
     assert(m_bundle_location == nullptr);
 
@@ -129,7 +135,7 @@ bool json_parser_t::parse_file(const pal::string_t& path)
         data += 3;
     }
 
-    return parse_raw_data(data, size, path);
+    return parse_fully_trusted_raw_data(data, size, path);
 }
 
 json_parser_t::~json_parser_t()
diff --git a/src/native/corehost/json_parser.h b/src/native/corehost/json_parser.h
index eb0b5d19a67963..389d5f42a54c20 100644
--- a/src/native/corehost/json_parser.h
+++ b/src/native/corehost/json_parser.h
@@ -36,8 +36,8 @@ class json_parser_t {
 
         const document_t& document() const { return m_document; }
 
-        bool parse_raw_data(char* data, int64_t size, const pal::string_t& context);
-        bool parse_file(const pal::string_t& path);
+        bool parse_fully_trusted_raw_data(char* data, int64_t size, const pal::string_t& context);
+        bool parse_fully_trusted_file(const pal::string_t& path);
 
         json_parser_t()
             : m_data(nullptr)
diff --git a/src/native/corehost/runtime_config.cpp b/src/native/corehost/runtime_config.cpp
index 04081ddbbea482..0785469d26f46e 100644
--- a/src/native/corehost/runtime_config.cpp
+++ b/src/native/corehost/runtime_config.cpp
@@ -343,7 +343,7 @@ bool runtime_config_t::ensure_dev_config_parsed()
     // runtimeconfig.dev.json is never bundled into the single-file app.
     // So, only a file on disk is processed.
     json_parser_t json;
-    if (!json.parse_file(m_dev_path))
+    if (!json.parse_fully_trusted_file(m_dev_path))
     {
         return false;
     }
@@ -410,7 +410,7 @@ bool runtime_config_t::ensure_parsed()
     }
 
     json_parser_t json;
-    if (!json.parse_file(m_path))
+    if (!json.parse_fully_trusted_file(m_path))
     {
         return false;
     }