[PM-40047] refactor: detect blob ciphers via format_version probe

src/Core/Vault/Entities/Cipher.cs

@@ -1,6 +1,7 @@
 // FIXME: Update this file to be null safe and then delete the line below
 #nullable disable
 
+using System.Text;
 using System.Text.Json;
 using Bit.Core.Entities;
 using Bit.Core.Utilities;
@@ -39,8 +40,34 @@ public bool IsDataBlobEncrypted()
             return false;
         }
 
-        var span = Data.AsSpan().TrimStart();
-        return span.Length > 0 && span[0] != '{';
+        try
+        {
+            var reader = new Utf8JsonReader(Encoding.UTF8.GetBytes(Data));
+
+            // Blob-encrypted data is a JSON object carrying a top-level "format_version"
+            // key; legacy field-level CipherData JSON never contains it. Probe only the
+            // top-level properties rather than materializing the whole document.
+            if (!reader.Read() || reader.TokenType != JsonTokenType.StartObject)
+            {
+                return false;
+            }
+
+            while (reader.Read() && reader.TokenType == JsonTokenType.PropertyName)
+            {
+                if (reader.ValueTextEquals("format_version"))
+                {
+                    return true;
+                }
+
+                reader.Skip();
+            }
+
+            return false;
+        }
+        catch (JsonException)
+        {
+            return false;
+        }
     }
 
     public Dictionary<string, CipherAttachment.MetaData> GetAttachments()

test/Core.Test/Vault/Models/CipherTests.cs

@@ -30,17 +30,21 @@ public void Clone_OrganizationCipher_CreatesExactCopy(Cipher cipher)
     [InlineData("   ")]
     [InlineData("{\"Name\":\"x\"}")]
     [InlineData("   { \"Name\": \"x\" }")]
-    public void IsDataBlobEncrypted_LegacyOrEmpty_ReturnsFalse(string? data)
+    [InlineData("2.iv|ct|mac")]
+    [InlineData("plain string")]
+    [InlineData("   2.iv|ct|mac")]
+    [InlineData("{\"other_key\":1}")]
+    [InlineData("\"format_version\"")]
+    public void IsDataBlobEncrypted_LegacyEmptyOrInvalid_ReturnsFalse(string? data)
     {
         var cipher = new Cipher { Data = data! };
         Assert.False(cipher.IsDataBlobEncrypted());
     }
 
     [Theory]
-    [InlineData("2.iv|ct|mac")]
-    [InlineData("plain string")]
-    [InlineData("   2.iv|ct|mac")]
-    public void IsDataBlobEncrypted_OpaqueData_ReturnsTrue(string data)
+    [InlineData("{\"format_version\":1,\"wrapped_cek\":\"abc\",\"envelope\":\"def\"}")]
+    [InlineData("   { \"format_version\": 1, \"wrapped_cek\": \"abc\", \"envelope\": \"def\" }")]
+    public void IsDataBlobEncrypted_BlobData_ReturnsTrue(string data)
     {
         var cipher = new Cipher { Data = data };
         Assert.True(cipher.IsDataBlobEncrypted());