fix: integer map keys when deserializing from a Value

Deserializing from an owned or borrowed Value by value
(`from_owned_value`, `from_borrowed_value`, `Value::deserialize_*`)
passed each object key as `Value::String`, so integer keys never parsed:

    let v = to_owned_value(br#"{"1":2}"#)?;
    from_owned_value::<BTreeMap<i64, u8>>(v)
        Err(invalid type: string "1", expected i64)

The by-reference path (`from_refowned_value`) and the text path accept
it, and so do serde_json and sonic-rs. Keys now go through
`MapKeyDeserializer` in all four Value paths. Its integer parsing also
used `str::parse`, which accepts `+1` and `01`; it now requires a JSON
integer, as the text deserializer does (`is_json_integer`).

Test: `value_map_integer_keys` (fails before this change).

Found by a differential fuzzer (serde_json, simd-json, sonic-rs, jiter).

Author: claude

src/serde/value/borrowed/de.rs

@@ -230,7 +230,8 @@ impl<'de> MapAccess<'de> for ObjectAccess<'de> {
         match self.i.next() {
             Some((k, v)) => {
                 self.v = Some(v);
-                seed.deserialize(Value::String(k)).map(Some)
+                // through the key deserializer, as for `&Value`: integer keys parse
+                seed.deserialize(MapKeyDeserializer::from_cow(k)).map(Some)
             }
             _ => Ok(None),
         }

src/serde/value/owned/de.rs

@@ -1,5 +1,6 @@
 // A lot of this logic is a re-implementation or copy of serde_json::Value
 use crate::ErrorType;
+use crate::cow::Cow;
 use crate::{Error, ObjectHasher};
 use crate::{
     prelude::*,
@@ -217,7 +218,9 @@ impl<'de> MapAccess<'de> for ObjectAccess {
         match self.i.next() {
             Some((k, v)) => {
                 self.v = Some(v);
-                seed.deserialize(Value::String(k)).map(Some)
+                // through the key deserializer, as for `&Value`: integer keys parse
+                seed.deserialize(MapKeyDeserializer::from_cow(Cow::from(k)))
+                    .map(Some)
             }
             _ => Ok(None),
         }

src/serde/value/shared.rs

@@ -4,26 +4,42 @@ use serde::de::{Unexpected, Visitor};
 use serde::forward_to_deserialize_any;
 use serde_ext::de::{self, IntoDeserializer};
 
+fn is_json_integer(s: &str) -> bool {
+    let digits = s.strip_prefix('-').unwrap_or(s).as_bytes();
+    match digits {
+        [b'0'] => true,
+        [b'1'..=b'9', rest @ ..] => rest.iter().all(u8::is_ascii_digit),
+        _ => false,
+    }
+}
+
 macro_rules! deserialize_integer_key {
     ($method:ident => $visit:ident) => {
         fn $method<V>(self, visitor: V) -> Result<V::Value, Self::Error>
         where
             V: Visitor<'de>,
         {
-            match (self.key.parse(), self.key) {
-                (Ok(integer), _) => visitor.$visit(integer),
+            // only a JSON integer (`-?(0|[1-9][0-9]*)`) is an integer key; `str::parse` alone also
+            // takes `+1` and `01`
+            let parsed = if is_json_integer(&self.key) {
+                self.key.parse().ok()
+            } else {
+                None
+            };
+            match (parsed, self.key) {
+                (Some(integer), _) => visitor.$visit(integer),
                 #[cfg(feature = "beef")]
-                (Err(_), s) => {
+                (None, s) => {
                     if s.is_borrowed() {
                         visitor.visit_borrowed_str(s.unwrap_borrowed())
                     } else {
                         visitor.visit_string(s.into_owned())
                     }
                 }
                 #[cfg(not(feature = "beef"))]
-                (Err(_), Cow::Borrowed(s)) => visitor.visit_borrowed_str(s),
+                (None, Cow::Borrowed(s)) => visitor.visit_borrowed_str(s),
                 #[cfg(not(feature = "beef"))]
-                (Err(_), Cow::Owned(s)) => visitor.visit_string(s),
+                (None, Cow::Owned(s)) => visitor.visit_string(s),
             }
         }
     };
@@ -40,6 +56,9 @@ impl<'de> MapKeyDeserializer<'de> {
             key: Cow::from(key),
         }
     }
+    pub(crate) fn from_cow(key: Cow<'de, str>) -> Self {
+        Self { key }
+    }
 }
 
 impl<'de> serde::Deserializer<'de> for MapKeyDeserializer<'de> {

src/tests/serde.rs

@@ -1374,3 +1374,53 @@ fn i128_map_keys() {
     let mut d = br#"{"340282366920938463463374607431768211456":1}"#.to_vec();
     assert!(from_slice::<BTreeMap<u128, u8>>(&mut d).is_err());
 }
+
+#[test]
+fn value_map_integer_keys() {
+    // From an owned/borrowed Value (not a reference), map keys were deserialized as plain
+    // strings, so integer keys failed; through `&Value` they parsed, but also accepted `+1`, `01`.
+    use crate::serde::{
+        from_borrowed_value, from_owned_value, from_refborrowed_value, from_refowned_value,
+    };
+    use std::collections::BTreeMap;
+    let ok = BTreeMap::from([(1_i64, 2_u8), (-7, 3)]);
+    let mut d = br#"{"1":2,"-7":3}"#.to_vec();
+    let v = to_owned_value(&mut d).expect("valid");
+    assert_eq!(
+        from_owned_value::<BTreeMap<i64, u8>>(v.clone()).ok(),
+        Some(ok.clone())
+    );
+    assert_eq!(
+        from_refowned_value::<BTreeMap<i64, u8>>(&v).ok(),
+        Some(ok.clone())
+    );
+    let mut d = br#"{"1":2,"-7":3}"#.to_vec();
+    let v = to_borrowed_value(&mut d).expect("valid");
+    assert_eq!(
+        from_borrowed_value::<BTreeMap<i64, u8>>(v.clone()).ok(),
+        Some(ok.clone())
+    );
+    assert_eq!(
+        from_refborrowed_value::<BTreeMap<i64, u8>>(&v).ok(),
+        Some(ok)
+    );
+    for key in ["+1", "01", "1x", " 1"] {
+        let mut d = format!(r#"{{"{key}":2}}"#).into_bytes();
+        let v = to_owned_value(&mut d).expect("valid");
+        assert!(
+            from_owned_value::<BTreeMap<i64, u8>>(v.clone()).is_err(),
+            "{key:?}"
+        );
+        assert!(
+            from_refowned_value::<BTreeMap<i64, u8>>(&v).is_err(),
+            "{key:?}"
+        );
+    }
+    // string keys are unchanged
+    let mut d = br#"{"01":2}"#.to_vec();
+    let v = to_owned_value(&mut d).expect("valid");
+    assert_eq!(
+        from_owned_value::<BTreeMap<String, u8>>(v).ok(),
+        Some(BTreeMap::from([("01".to_string(), 2)]))
+    );
+}