Add internal JSON backend option

.github/instructions/copilot-instructions.md

@@ -1,92 +0,0 @@
-# Copilot Review Instructions for TinyGLTF
-
-This document provides guidelines for reviewing code changes in the TinyGLTF repository.
-
-## Memory Safety
-
-- **Buffer Overflows**: Check for proper bounds checking when accessing arrays, vectors, and buffers. Verify that buffer sizes are validated before read/write operations.
-- **Null Pointer Dereferences**: Ensure all pointers are checked for null before dereferencing, especially when handling optional glTF fields.
-- **Memory Leaks**: Verify proper resource management, including RAII patterns for file handles, image data, and dynamically allocated memory.
-- **Use-After-Free**: Check for proper lifetime management of objects, especially when dealing with callbacks and asynchronous operations.
-
-## Error Handling
-
-- **File I/O**: Verify that all file operations have proper error checking and meaningful error messages.
-- **JSON Parsing**: Ensure JSON parsing errors are caught and reported with helpful context about the location and nature of the error.
-- **Resource Loading**: Check that failures in loading images, buffers, and other resources are properly handled and don't cause crashes.
-- **Error Propagation**: Verify that errors are properly propagated through the call stack with appropriate error messages.
-
-## glTF 2.0 Specification Compliance
-
-- **Required Fields**: Ensure all required glTF fields are validated and present.
-- **Data Types**: Verify that data types match the glTF specification (e.g., component types, accessor types).
-- **Constraints**: Check that glTF constraints are enforced (e.g., valid ranges for enums, buffer stride requirements).
-- **Extensions**: Verify proper handling of glTF extensions and that unknown extensions are handled gracefully.
-- **Validation**: Ensure new features align with the glTF 2.0 specification from the Khronos Group.
-
-## Cross-Platform Compatibility
-
-- **Windows**: Check for proper handling of Windows-specific issues (path separators, line endings, file operations).
-- **Linux**: Verify compatibility with various Linux distributions and compilers (GCC, Clang).
-- **macOS**: Ensure macOS-specific considerations are addressed (case-sensitive filesystems, Clang compatibility).
-- **Mobile Platforms**: Consider Android and iOS compatibility where applicable.
-- **Endianness**: Verify proper handling of byte order when reading binary data.
-- **Compiler Compatibility**: Ensure code compiles with C++11 standard and supported compilers (MSVC, GCC, Clang).
-
-## Edge Cases in glTF Parsing
-
-- **Empty/Minimal Files**: Verify handling of minimal valid glTF files.
-- **Large Files**: Check for proper handling of large glTF files and buffers without memory exhaustion.
-- **Malformed Data**: Ensure graceful handling of malformed or invalid glTF data.
-- **Missing Optional Fields**: Verify correct behavior when optional glTF fields are absent.
-- **Edge Values**: Check handling of boundary values (e.g., maximum buffer sizes, extreme floating-point values).
-- **Base64 Encoding**: Verify proper handling of base64-encoded data URIs and invalid encodings.
-
-## Backwards Compatibility
-
-- **API Changes**: Ensure public API changes maintain backwards compatibility or are properly deprecated.
-- **Breaking Changes**: Flag any breaking changes for major version updates and document migration paths.
-- **Binary Compatibility**: Consider ABI stability for header-only library changes.
-- **Default Behavior**: Verify that default behavior of existing functionality remains unchanged.
-
-## Performance Considerations
-
-- **Parsing Performance**: Check for unnecessary copies, redundant allocations, and inefficient algorithms in parsing logic.
-- **Memory Usage**: Verify efficient memory usage, especially when loading large glTF files.
-- **I/O Operations**: Ensure efficient file reading and minimize unnecessary disk access.
-- **String Operations**: Check for efficient string handling (use of string_view, move semantics).
-- **STL Usage**: Verify appropriate use of STL containers and algorithms.
-
-## Documentation
-
-- **Public API**: Ensure all public functions, classes, and methods have clear documentation comments.
-- **Parameters**: Verify that function parameters are documented, including expected ranges and constraints.
-- **Return Values**: Document return values and possible error conditions.
-- **Examples**: Check that complex features include usage examples.
-- **Changelog**: Verify that significant changes are documented in release notes or changelog.
-
-## Testing
-
-- **Test Coverage**: Ensure new features include appropriate unit tests or integration tests.
-- **Edge Cases**: Verify that tests cover edge cases and error conditions.
-- **Cross-Platform Tests**: Check that tests run on all supported platforms.
-- **Regression Tests**: Ensure bug fixes include regression tests to prevent recurrence.
-- **Sample Files**: Verify that changes are tested with various valid and invalid glTF sample files.
-
-## Code Style Consistency
-
-- **Header-Only Pattern**: Maintain the header-only library structure.
-- **Naming Conventions**: Follow existing naming conventions (CamelCase for types, snake_case for functions where applicable).
-- **Formatting**: Adhere to the existing code formatting style (check `.clang-format` if available).
-- **Include Guards**: Verify proper include guards and header organization.
-- **Namespace Usage**: Ensure proper use of the `tinygltf` namespace.
-- **Comments**: Maintain consistent comment style with existing code.
-- **C++11 Compliance**: Verify that code uses C++11 features appropriately and doesn't require newer standards unless specified.
-
-## Additional Considerations
-
-- **Third-Party Dependencies**: Minimize new dependencies; prefer existing dependencies (json.hpp, stb_image).
-- **Warnings**: Ensure code compiles without warnings on supported compilers.
-- **const Correctness**: Verify proper use of const for parameters and methods.
-- **RAII**: Prefer RAII patterns for resource management over manual cleanup.
-- **noexcept**: Use noexcept appropriately for move constructors and move assignment operators.

AGENTS.md

@@ -0,0 +1,34 @@
+# Repository Guidelines
+
+## Project Structure & Module Organization
+- Core library lives in `tiny_gltf.h` (header-only) with `tiny_gltf.cc` provided for the amalgamated implementation flags. Keep public API updates localized and documented.
+- Example viewers and utilities sit under `examples/`; use them as references for loading, validation, and WASM builds. Temporary build outputs belong in `build/` (git-ignored).
+- Tests reside in `tests/` with sample assets in `data/` and `models/`; avoid committing generated binaries in `build/`, `tmp/`, or `tests/tester*`.
+
+## Build, Test, and Development Commands
+- Quick build of the loader example: `make` (uses clang++, C++11, optional `EXTRA_CXXFLAGS` for sanitizers).
+- Unit tests: `cd tests && make && ./tester && ./tester_noexcept`.
+- Parsing regression run: build `loader_example`, then `python test_runner.py` (requires local glTF-Sample-Models checkout and path update inside the script).
+- CMake alternative: `cmake -S . -B build && cmake --build build` for IDE integration or non-clang toolchains.
+- Lint header: `python deps/cpplint.py tiny_gltf.h`.
+
+## Coding Style & Naming Conventions
+- C++11, two-space indent, braces on the same line; mirror existing spacing and comment style in `tiny_gltf.h`.
+- Prefer `std::` facilities and minimal dependencies; keep new symbols in the `tinygltf` namespace.
+- Public API names stay PascalCase for types and camelCase for functions; keep enums/macros consistent with existing `TINYGLTF_*` patterns.
+- Guard optional features with the established `TINYGLTF_*` defines; avoid introducing new globals without discussion.
+
+## Testing Guidelines
+- Framework: Catch2 single-header (`tests/catch.hpp`); add `TEST_CASE` blocks alongside related helpers in `tests/tester.cc`.
+- Provide coverage for both exception-enabled and `TINYGLTF_NOEXCEPTION` builds; run both `tester` binaries before submitting.
+- For new formats or parsing code, add assets under `tests/` or reference `data/` and note provenance.
+
+## Commit & Pull Request Guidelines
+- Commit messages: concise, present-tense imperatives mirroring existing history (e.g., “Add bounds check to images loaded from bufferviews”).
+- PRs should describe the change, motivation, and testing (`tester`, `tester_noexcept`, fuzzing if relevant); link related issues.
+- Include platform notes if behavior differs (Windows vs. POSIX, filesystem callbacks, WASM). Add before/after metrics when touching performance-sensitive paths.
+
+## Security & Configuration Tips
+- Handle external data defensively: validate buffer sizes, offsets, and URI handling; prefer bounded allocations.
+- Keep optional callbacks (`fs::`, URI, image) robust against untrusted input; document new failure modes.
+- Avoid committing sample assets with unclear licensing; reuse existing test fixtures where possible.

CMakeLists.txt

@@ -14,7 +14,6 @@ option(TINYGLTF_BUILD_LOADER_EXAMPLE "Build loader_example(load glTF and dump in
 option(TINYGLTF_BUILD_GL_EXAMPLES "Build GL exampels(requires glfw, OpenGL, etc)" OFF)
 option(TINYGLTF_BUILD_VALIDATOR_EXAMPLE "Build validator exampe" OFF)
 option(TINYGLTF_BUILD_BUILDER_EXAMPLE "Build glTF builder example" OFF)
-option(TINYGLTF_BUILD_TESTS "Build unit tests" OFF)
 option(TINYGLTF_HEADER_ONLY "On: header-only mode. Off: create tinygltf library(No TINYGLTF_IMPLEMENTATION required in your project)" OFF)
 option(TINYGLTF_INSTALL "Install tinygltf files during install step. Usually set to OFF if you include tinygltf through add_subdirectory()" ON)
 option(TINYGLTF_INSTALL_VENDOR "Install vendored nlohmann/json and nothings/stb headers" ON)
@@ -38,16 +37,6 @@ if (TINYGLTF_BUILD_BUILDER_EXAMPLE)
   add_subdirectory ( examples/build-gltf )
 endif (TINYGLTF_BUILD_BUILDER_EXAMPLE)
 
-if (TINYGLTF_BUILD_TESTS)
-  enable_testing()
-  add_executable(tester tests/tester.cc)
-  target_include_directories(tester PRIVATE
-    ${CMAKE_CURRENT_SOURCE_DIR}
-    ${CMAKE_CURRENT_SOURCE_DIR}/tests
-  )
-  add_test(NAME tester COMMAND tester WORKING_DIRECTORY ${CMAKE_CURRENT_SOURCE_DIR}/tests)
-endif (TINYGLTF_BUILD_TESTS)
-
 #
 # for add_subdirectory and standalone build
 #

README.md

@@ -159,10 +159,9 @@ Model model;
 TinyGLTF loader;
 std::string err;
 std::string warn;
-std::string filename = "input.gltf";
 
-bool ret = loader.LoadASCIIFromFile(&model, &err, &warn, filename);
-//bool ret = loader.LoadBinaryFromFile(&model, &err, &warn, filename); // for binary glTF(.glb)
+bool ret = loader.LoadASCIIFromFile(&model, &err, &warn, argv[1]);
+//bool ret = loader.LoadBinaryFromFile(&model, &err, &warn, argv[1]); // for binary glTF(.glb)
 
 if (!warn.empty()) {
   printf("Warn: %s\n", warn.c_str());
@@ -173,7 +172,8 @@ if (!err.empty()) {
 }
 
 if (!ret) {
-  printf("Failed to parse glTF: %s\n", filename.c_str());
+  printf("Failed to parse glTF\n");
+  return -1;
 }
 ```
 
@@ -194,6 +194,7 @@ if (!ret) {
 * `TINYGLTF_NO_INCLUDE_STB_IMAGE `: Disable including `stb_image.h` from within `tiny_gltf.h` because it has been already included before or you want to include it using custom path before including `tiny_gltf.h`.
 * `TINYGLTF_NO_INCLUDE_STB_IMAGE_WRITE `: Disable including `stb_image_write.h` from within `tiny_gltf.h` because it has been already included before or you want to include it using custom path before including `tiny_gltf.h`.
 * `TINYGLTF_USE_RAPIDJSON` : Use RapidJSON as a JSON parser/serializer. RapidJSON files are not included in TinyGLTF repo. Please set an include path to RapidJSON if you enable this feature.
+* `TINYGLTF_USE_CPP14` : Use C++14 feature(requires C++14 compiler). This may give better performance than C++11.
 
 
 ## CMake options

tests/tester.cc

@@ -4,7 +4,9 @@
 #include "tiny_gltf.h"
 
 // Nlohmann json(include ../json.hpp)
+#if !defined(TINYGLTF_USE_INTERNAL_JSON) && !defined(TINYGLTF_USE_RAPIDJSON)
 #include "json.hpp"
+#endif
 
 #define CATCH_CONFIG_MAIN  // This tells Catch to provide a main() - only do this in one cpp file
 #include "catch.hpp"
@@ -758,6 +760,194 @@ TEST_CASE("load-issue-416-model", "[issue-416]") {
   REQUIRE(true == ret);
 }
 
+TEST_CASE("reject-unsafe-paths", "[security]") {
+  tinygltf::TinyGLTF ctx;
+
+  SECTION("parent-directory reference is rejected") {
+    tinygltf::Model model;
+    std::string err;
+    std::string warn;
+
+    const std::string gltf = R"({
+      "asset": {"version": "2.0"},
+      "buffers": [
+        {"uri": "../secret.bin", "byteLength": 4}
+      ]
+    })";
+
+    bool ret = ctx.LoadASCIIFromString(&model, &err, &warn, gltf.c_str(),
+                                       static_cast<unsigned int>(gltf.size()),
+                                       ".");
+    REQUIRE_FALSE(ret);
+    REQUIRE_THAT(err, Catch::Contains("Rejected unsafe filename"));
+  }
+
+  SECTION("absolute path is rejected") {
+    tinygltf::Model model;
+    std::string err;
+    std::string warn;
+
+    const std::string gltf = R"({
+      "asset": {"version": "2.0"},
+      "buffers": [
+        {"uri": "/tmp/secret.bin", "byteLength": 4}
+      ]
+    })";
+
+    bool ret = ctx.LoadASCIIFromString(&model, &err, &warn, gltf.c_str(),
+                                       static_cast<unsigned int>(gltf.size()),
+                                       ".");
+    REQUIRE_FALSE(ret);
+    REQUIRE_THAT(err, Catch::Contains("Rejected unsafe filename"));
+  }
+}
+
+TEST_CASE("data-uri-size-limit", "[security]") {
+  tinygltf::TinyGLTF ctx;
+  ctx.SetMaxDataURISize(16);  // small limit to exercise rejection path.
+
+  const std::string payload(24, 'A');  // decodes to 18 bytes.
+  const std::string data_uri =
+      "data:application/octet-stream;base64," + payload;
+  const std::string gltf = R"({
+    "asset": {"version": "2.0"},
+    "buffers": [
+      {"uri": ")" + data_uri + R"(", "byteLength": 18}
+    ]
+  })";
+
+  tinygltf::Model model;
+  std::string err;
+  std::string warn;
+
+  bool ret = ctx.LoadASCIIFromString(&model, &err, &warn, gltf.c_str(),
+                                     static_cast<unsigned int>(gltf.size()),
+                                     ".");
+  REQUIRE_FALSE(ret);
+  REQUIRE_THAT(err,
+               Catch::Contains("Data URI for buffer exceeds maximum allowed"));
+
+  SECTION("ceiling estimation rejects near-limit payloads") {
+    tinygltf::TinyGLTF ctx2;
+    ctx2.SetMaxDataURISize(4);
+    // 8 chars base64 -> 6 decoded bytes, should be rejected by max size.
+    const std::string small_payload(8, 'A');
+    const std::string small_uri =
+        "data:application/octet-stream;base64," + small_payload;
+    const std::string gltf_small = R"({
+      "asset": {"version": "2.0"},
+      "buffers": [
+        {"uri": ")" + small_uri + R"(", "byteLength": 6}
+      ]
+    })";
+
+    tinygltf::Model m2;
+    std::string err2;
+    std::string warn2;
+    bool ok = ctx2.LoadASCIIFromString(
+        &m2, &err2, &warn2, gltf_small.c_str(),
+        static_cast<unsigned int>(gltf_small.size()), ".");
+    REQUIRE_FALSE(ok);
+    REQUIRE_THAT(err2,
+                 Catch::Contains("Data URI for buffer exceeds maximum allowed"));
+  }
+}
+
+TEST_CASE("max-external-file-size", "[security]") {
+  tinygltf::TinyGLTF ctx;
+  ctx.SetMaxExternalFileSize(16);  // small limit to force rejection.
+
+  const std::string gltf_path = "oversize.gltf";
+  {
+    std::ofstream ofs(gltf_path, std::ios::binary);
+    ofs << R"({"asset":{"version":"2.0"}})" << std::string(64, ' ');
+  }
+
+  tinygltf::Model model;
+  std::string err;
+  std::string warn;
+  bool ok = ctx.LoadASCIIFromFile(&model, &err, &warn, gltf_path);
+  REQUIRE_FALSE(ok);
+  REQUIRE_THAT(err,
+               Catch::Contains("exceeds maximum allowed file size"));
+  std::remove(gltf_path.c_str());
+
+  const std::string glb_path = "oversize.glb";
+  {
+    std::ofstream ofs(glb_path, std::ios::binary);
+    ofs << std::string(32, '\0');
+  }
+
+  err.clear();
+  warn.clear();
+  ok = ctx.LoadBinaryFromFile(&model, &err, &warn, glb_path);
+  REQUIRE_FALSE(ok);
+  REQUIRE_THAT(err,
+               Catch::Contains("exceeds maximum allowed file size"));
+  std::remove(glb_path.c_str());
+}
+
+TEST_CASE("max-size-in-memory", "[security]") {
+  tinygltf::TinyGLTF ctx;
+  ctx.SetMaxExternalFileSize(16);
+
+  // LoadASCIIFromString should reject oversized input.
+  {
+    tinygltf::Model model;
+    std::string err;
+    std::string warn;
+    std::string large_json(20, ' ');
+    bool ok = ctx.LoadASCIIFromString(
+        &model, &err, &warn, large_json.c_str(),
+        static_cast<unsigned int>(large_json.size()), ".");
+    REQUIRE_FALSE(ok);
+    REQUIRE_THAT(err, Catch::Contains("Input size exceeds maximum"));
+  }
+
+  // LoadBinaryFromMemory should reject oversized input even before parsing.
+  {
+    tinygltf::Model model;
+    std::string err;
+    std::string warn;
+    std::array<unsigned char, 32> bytes{};
+    // Craft minimal glTF header; size still exceeds limit and should be
+    // rejected early.
+    bytes[0] = 'g'; bytes[1] = 'l'; bytes[2] = 'T'; bytes[3] = 'F';
+    bytes[4] = 2; // version little-endian
+    bool ok = ctx.LoadBinaryFromMemory(&model, &err, &warn, bytes.data(),
+                                       static_cast<unsigned int>(bytes.size()),
+                                       ".");
+    REQUIRE_FALSE(ok);
+    REQUIRE_THAT(err, Catch::Contains("Input size exceeds maximum"));
+  }
+
+  SECTION("GLB length mismatch is rejected in strict mode") {
+    tinygltf::TinyGLTF ctx_strict;
+    ctx_strict.SetParseStrictness(tinygltf::ParseStrictness::Strict);
+
+    // Construct a minimal GLB with length field smaller than actual buffer.
+    std::array<unsigned char, 32> glb{};
+    glb[0] = 'g'; glb[1] = 'l'; glb[2] = 'T'; glb[3] = 'F';
+    glb[4] = 2; // version
+    uint32_t length = 24; // claimed length (smaller than actual buffer size)
+    memcpy(&glb[8], &length, 4);
+    uint32_t json_len = 4;
+    memcpy(&glb[12], &json_len, 4);
+    uint32_t json_fmt = 0x4E4F534A; // "JSON"
+    memcpy(&glb[16], &json_fmt, 4);
+
+    tinygltf::Model model;
+    std::string err;
+    std::string warn;
+    bool ok = ctx_strict.LoadBinaryFromMemory(
+        &model, &err, &warn, glb.data(),
+        static_cast<unsigned int>(glb.size()), ".");
+    REQUIRE_FALSE(ok);
+    REQUIRE_THAT(err,
+                 Catch::Contains("Length field does not match data size"));
+  }
+}
+
 TEST_CASE("serialize-empty-node", "[issue-457]") {
   tinygltf::Model m;
   // Add default constructed node to model
@@ -1121,10 +1311,8 @@ TEST_CASE("images-as-is", "[issue-487]") {
     // All the images should have been written to disk with their original data
     for (const auto& image : model.images)  {
       // Make sure the image files exist
-      {
-        std::fstream file(image.uri);
-        CHECK(file.good());
-      } // Close file before stbi_load (Windows sharing violation fix)
+      std::fstream file(image.uri);
+      CHECK(file.good());
 #ifndef TINYGLTF_NO_STB_IMAGE
       // Make sure we can load the images
       int w = -1, h = -1, component = -1;