Cleanup

Author: Nigusu-Allehu

src/NuGet.Core/NuGet.Protocol/Converters/MetadataStringOrArrayStjConverter.cs

@@ -17,17 +17,17 @@ internal sealed class MetadataStringOrArrayStjConverter : JsonConverter<IReadOnl
     {
         public override IReadOnlyList<string>? Read(ref Utf8JsonReader reader, Type typeToConvert, JsonSerializerOptions options)
         {
-            if (reader.TokenType == JsonTokenType.Null)
-            {
-                return null;
-            }
-
             if (reader.TokenType == JsonTokenType.String)
             {
                 var str = reader.GetString();
                 return string.IsNullOrWhiteSpace(str) ? null : new[] { str! };
             }
 
+            if (reader.TokenType != JsonTokenType.StartArray)
+            {
+                throw new JsonException(string.Format(System.Globalization.CultureInfo.CurrentCulture, Strings.Error_UnexpectedJsonToken, reader.TokenType));
+            }
+
             var values = new List<string>();
             while (reader.Read() && reader.TokenType != JsonTokenType.EndArray)
             {

src/NuGet.Core/NuGet.Protocol/Converters/NuGetVersionStjConverter.cs

@@ -13,11 +13,6 @@ internal sealed class NuGetVersionStjConverter : JsonConverter<NuGetVersion>
     {
         public override NuGetVersion? Read(ref Utf8JsonReader reader, Type typeToConvert, JsonSerializerOptions options)
         {
-            if (reader.TokenType == JsonTokenType.Null)
-            {
-                return null;
-            }
-
             var str = reader.GetString();
             return str is null ? null : NuGetVersion.Parse(str);
         }

src/NuGet.Core/NuGet.Protocol/Converters/PackageDependencyGroupStjConverter.cs

@@ -11,10 +11,7 @@
 
 namespace NuGet.Protocol.Converters
 {
-    /// <remarks>
-    /// No explicit NSJ equivalent — NSJ relies on <c>[JsonConstructor]</c> and <c>[JsonProperty]</c> attributes
-    /// on <see cref="PackageDependencyGroup"/> in NuGet.Packaging. STJ ignores those attributes, requiring this converter.
-    /// </remarks>
+    /// <remarks>No NSJ equivalent.</remarks>
     internal sealed class PackageDependencyGroupStjConverter : JsonConverter<PackageDependencyGroup>
     {
         private static readonly PackageDependencyStjConverter _dependencyConverter = new();

src/NuGet.Core/NuGet.Protocol/Converters/PackageDependencyStjConverter.cs

@@ -2,17 +2,15 @@
 // Licensed under the Apache License, Version 2.0. See License.txt in the project root for license information.
 
 using System;
+using System.Globalization;
 using System.Text.Json;
 using System.Text.Json.Serialization;
 using NuGet.Packaging.Core;
 using NuGet.Versioning;
 
 namespace NuGet.Protocol.Converters
 {
-    /// <remarks>
-    /// No explicit NSJ equivalent — NSJ relies on <c>[JsonConstructor]</c> and <c>[JsonProperty]</c> attributes
-    /// on <see cref="PackageDependency"/> in NuGet.Packaging. STJ ignores those attributes, requiring this converter.
-    /// </remarks>
+    /// <remarks>No NSJ equivalent.</remarks>
     internal sealed class PackageDependencyStjConverter : JsonConverter<PackageDependency>
     {
         private static readonly VersionRangeStjConverter _versionRangeConverter = new();
@@ -54,6 +52,11 @@ public override PackageDependency Read(ref Utf8JsonReader reader, Type typeToCon
                 }
             }
 
+            if (string.IsNullOrEmpty(id))
+            {
+                throw new JsonException(string.Format(System.Globalization.CultureInfo.CurrentCulture, Strings.Error_RequiredJsonPropertyMissing, JsonProperties.PackageId));
+            }
+
             return new PackageDependency(id!, range);
         }
 

src/NuGet.Core/NuGet.Protocol/Converters/SafeUriStjConverter.cs

@@ -12,11 +12,6 @@ internal sealed class SafeUriStjConverter : JsonConverter<Uri>
     {
         public override Uri? Read(ref Utf8JsonReader reader, Type typeToConvert, JsonSerializerOptions options)
         {
-            if (reader.TokenType == JsonTokenType.Null)
-            {
-                return null;
-            }
-
             if (reader.TokenType == JsonTokenType.String)
             {
                 Uri.TryCreate(reader.GetString()?.Trim(), UriKind.Absolute, out Uri? uri);

src/NuGet.Core/NuGet.Protocol/Converters/VersionInfoStjConverter.cs

@@ -2,6 +2,7 @@
 // Licensed under the Apache License, Version 2.0. See License.txt in the project root for license information.
 
 using System;
+using System.Globalization;
 using System.Text.Json;
 using System.Text.Json.Serialization;
 using NuGet.Protocol.Core.Types;
@@ -46,6 +47,11 @@ public override VersionInfo Read(ref Utf8JsonReader reader, Type typeToConvert,
                 }
             }
 
+            if (string.IsNullOrEmpty(version))
+            {
+                throw new JsonException(string.Format(CultureInfo.CurrentCulture, Strings.Error_RequiredJsonPropertyMissing, JsonProperties.Version));
+            }
+
             return new VersionInfo(NuGetVersion.Parse(version!), downloads);
         }
 

src/NuGet.Core/NuGet.Protocol/Strings.Designer.cs

@@ -543,4 +543,11 @@ The "s" should be localized to the abbreviation for seconds.</comment>
     <value>Expected package {0} {1}, but got package {2} {3}</value>
     <comment>0 and 2 are package names, and 1 and 3 are version numbers</comment>
   </data>
+  <data name="Error_UnexpectedJsonToken" xml:space="preserve">
+    <value>Unexpected JSON token '{0}'.</value>
+  </data>
+  <data name="Error_RequiredJsonPropertyMissing" xml:space="preserve">
+    <value>Required JSON property '{0}' is missing.</value>
+    <comment>0 - property name</comment>
+  </data>
 </root>

src/NuGet.Core/NuGet.Protocol/Strings.resx

@@ -119,6 +119,19 @@ public void MetadataStringOrArrayStjConverter_OnNullOrWhitespace_ReturnsNull(str
             actual.Should().BeNull();
         }
 
+        [Theory]
+        [InlineData("42")]
+        [InlineData("true")]
+        [InlineData("{}")]
+        public void MetadataStringOrArrayStjConverter_OnUnexpectedTokenType_ThrowsJsonException(string json)
+        {
+            // Act
+            var act = () => Deserialize<IReadOnlyList<string>>(json, new MetadataStringOrArrayStjConverter());
+
+            // Assert
+            act.Should().Throw<JsonException>();
+        }
+
         [Theory]
         [InlineData("""{"version":"1.0.0","downloads":12345}""", "1.0.0", 12345L)]
         [InlineData("""{"version":"2.0.0-beta"}""", "2.0.0-beta", null)]
@@ -166,6 +179,18 @@ public void PackageDependencyStjConverter_OnObject_ReturnsCorrectDependency(stri
             actual.VersionRange.Should().Be(expectedVersionRange);
         }
 
+        [Theory]
+        [InlineData("{}")]
+        [InlineData("""{"range":"[1.0.0, )"}""")]
+        public void PackageDependencyStjConverter_OnMissingId_ThrowsJsonException(string json)
+        {
+            // Act
+            var act = () => Deserialize<PackageDependency>(json, new PackageDependencyStjConverter());
+
+            // Assert
+            act.Should().Throw<JsonException>();
+        }
+
         [Fact]
         public void PackageDependencyStjConverter_OnRoundTrip_PreservesValues()
         {