Determine whether JSON object is included in another JSON object

Some time ago I had to create method that will determine whether first JSON object is included in second JSON object. Then I created very simple method:

public static partial class JsonOperations
{
    [GeneratedRegex(@"\[\d+\]", RegexOptions.Compiled)]
    private static partial Regex FindArrayIndexers();

    private static IEnumerable<string> GetJsonValuesIdentifiers(IEnumerable<JValue> values)
    {
        return values.Select(p => $"{FindArrayIndexers().Replace(p.Path, string.Empty)}:{p.Value?.ToString()}");
    }

    public static bool IsIncludedIn(this JObject first, JObject second)
    {
        var firstIdentifiers = GetJsonValuesIdentifiers(first.Descendants().OfType<JValue>());
        var secondIdentifiers = GetJsonValuesIdentifiers(second.Descendants().OfType<JValue>());

        return firstIdentifiers.All(secondIdentifiers.Contains);
    }
}

How it works? I get descendants of JSON object which are JValue, so simple objects like int, string etc. Later I get JSON Path of every JValue and remove array indexers from it using REGEX. For example: .type.arr[0].xyz is transformed to .type.arr.xyz, so the order of these values doesn't matter. Later I combine it with value and I get identifier, e.g. .type.arr.xyz:some-string-value. At the end I just check if all identifiers from first JSON object are contained in second JSON object.

It seemed to work fine, but I noticed bug that causes serious security issue in my case.

Imagine a object like:

{
   "geolocation":[
      {
         "lat":-32.364,
         "lng":158.207
      },
      {
         "lat":-35.364,
         "lng":153.207
      }
   ]
}

And the second:

{
   "geolocation":[
      {
         "lat":-32.364,
         "lng":153.207 <-- It's exchanged
      },
      {
         "lat":-35.364,
         "lng":158.207 <-- Exchanged with this
      }
   ]
}

The method I provided will say that first object is included in second, but that's not true. Yes, the "identifiers" I already mentioned are all included, but "looking at it as a whole", in this case, we see, that the two objects of array says about different coordinates.

Also, general assumption is that the compared JSONs have always the same structure. If not, then first cannot be included in second.

I hope you understood problem, it's hard to explain for me, but if you have any questions please ask.

The key to success is to provide more context to JSON identifiers by grouping them. That's fully working code:

public static partial class JsonOperations
{
    [GeneratedRegex(@"\[\d+\]", RegexOptions.Compiled)]
    private static partial Regex FindArrayIndexers();

    private static IEnumerable<IGrouping<string, string>> GetGroupedIdentifiers(IEnumerable<JValue> values)
    {
        // Group by path to last ] characters, so to the last array indexer.
        // Doing this we avoid mixing properties from different objects inside one array but with the same properties with the same values
        return values.GroupBy(p => p.Path.IndexOf(']') != -1 ? p.Path[0..(p.Path.LastIndexOf(']') + 1)] : p.Path,
            v => $"{FindArrayIndexers().Replace(v.Path, string.Empty)}:{v.Value?.ToString()}");
    }

    public static bool IsIncludedIn(this JObject first, JObject second)
    {
        var firstGroupedIdentifiers = GetGroupedIdentifiers(first.Descendants().OfType<JValue>());
        var secondGroupedIdentifiers = GetGroupedIdentifiers(second.Descendants().OfType<JValue>());

        foreach (var firstGrouping in firstGroupedIdentifiers)
        {
            // sg - second grouping
            // fgId - identifier from first grouping
            // sgId - identifier from second grouping
            // Work: whether there is any grouping from secondGroupedIdentifiers where all of first grouping (currently iterated) identifiers are contained in second grouping
            var appropriateGroupingExists = secondGroupedIdentifiers.Any(sg =>
                firstGrouping.Select(fgId => fgId).All(fgId => sg.Select(sgId => sgId).Contains(fgId)));

            if (!appropriateGroupingExists)
                return false;
        }

        return true;
    }
}

I have tested in on JSON provided in question and generated by: https://json-generator.com

Please notice assumption contained in question. This code works only (in accordance with assumption) if JSON structures are the same. If they are not, it won't work.