Module json_walk 

Ordered JSON body walk, ported from the Go engine’s jsonwalk.go, which ports guard_core/_utils/body_json_scan.py and embedded_json_scan.py.

The reference engine parses with json.loads (dict insertion order) and walks the tree depth-first in insertion order: for each object entry the key is checked against the mongo-operator-key registry (a direct nosql hit reported without a pattern scan) and scanned as a name; then the entry value descends. Objects and arrays deeper than the JSON depth cap are serialized back to compact JSON and scanned as one text value. Scalar leaves scan str(value).

Values parsed out of a form or multipart field string walk with the field context plus the crate::detect::EMBEDDED_JSON_LEAF_CONTEXT_SUFFIX (embedded_json_scan.py), and such a leaf string that itself parses as a JSON object or array walks again with another suffix, exactly like _check_embedded_json short-circuiting the raw value scan. The top-level JSON body walk keeps the plain request_body context and never re-parses leaf strings (the reference skips the embedded check when the context is exactly request_body).

Deviations: number leaves scan the literal JSON text instead of Python’s float repr (Python’s arbitrary-precision ints render identically); a lone surrogate escape becomes U+FFFD at the decode boundary (the engine string model) instead of Python’s lone surrogate rune; parse recursion is bounded like Python’s json.loads recursion limit, so deeper bodies fall back to the blob scan exactly as a RecursionError does in the reference.

Structs

JsonNode

One node of the ordered parse tree. Duplicate object keys keep the first insertion position and the last value (Python dict semantics).

Constants

JSON_WALK_DEPTH_CAP

JSON walk depth cap (_json_depth_cap_value default): containers at or beyond this walk depth serialize back to compact JSON and scan as text.

Functions

parse_ordered_json

parseOrderedJSON: parse s and return the root when it is a JSON object or array.

serialize_compact_json

Render a subtree the way json.dumps(value, separators=(",", ":"), ensure_ascii=False) does for the depth-capped subtree scan.