[patch][cla] dojox.json.ref.toJson handles references unsafely

[avoidscorn]

dojox.json.ref.toJson can leave a generated __id attribute on the root object if it generates a $ref in the JSON. The culprit is the recursive call on line 284, which causes generated['#'] to point to the refObject instead of the root object. As a result, the generated __id on the root object does not get cleaned up.

While this may seem like a minor issue, it can cause more serious problems. If dojox.json.ref.toJson is called again with a different root object that contains the old root object via some path, then it will emit a nonsensical '{"$ref":"#"}' when serializing the old root object. For example, when oldRoot.__id === "#", then dojox.json.ref.toJson({a: oldRoot}) will return '{"a":{"$ref":"#"}}'.

The attached patch uses dojo.toJson to serialize the refObject which resolves the problem with no issues AFAICT. It also contains a test case for this issue.

[dylan]

Kris, is json referencing still something we are maintaining?

[Kris Zyp]

In [30705]:

Fix reference object serialization, fixes #10740 !strict