untrusted input should validate .op against the parser's operator set themselves

[aj1126]

Prior to upgrading, callers that build object tokens from untrusted input should validate .op against the parser's operator set themselves, and never construct { op } from attacker-controlled strings.