Fix JSON.generate strict: true mode to also restrict hash keys

Author: byroot

CHANGES.md

@@ -2,6 +2,8 @@
 
 ### Unreleased
 
+* Fix `JSON.generate` `strict: true` mode to also restrict hash keys.
+
 ### 2025-07-28 (2.13.2)
 
 * Improve duplicate key warning and errors to include the key name and point to the right caller.

ext/json/ext/generator/generator.c

@@ -1041,6 +1041,9 @@ json_object_i(VALUE key, VALUE val, VALUE _arg)
             key_to_s = rb_sym2str(key);
             break;
         default:
+            if (data->state->strict) {
+                raise_generator_error(key, "%"PRIsVALUE" not allowed in JSON", rb_funcall(key, i_to_s, 0));
+            }
             key_to_s = rb_convert_type(key, T_STRING, "String", "to_s");
             break;
     }

test/json/json_generator_test.rb

@@ -404,6 +404,18 @@ def test_json_generate_unsupported_types
     assert_raise JSON::GeneratorError do
       generate(Object.new, strict: true)
     end
+
+    assert_raise JSON::GeneratorError do
+      generate([Object.new], strict: true)
+    end
+
+    assert_raise JSON::GeneratorError do
+      generate({ "key" => Object.new }, strict: true)
+    end
+
+    assert_raise JSON::GeneratorError do
+      generate({ Object.new => "value" }, strict: true)
+    end
   end
 
   def test_nesting