Subject: FYI: JSON parsing

From: Mark Nottingham <[email-masked]>
Date: Thu, 27 Oct 2016 11:50:47 +1100

For those who haven't seen it, this is a pretty deep dive on JSON parsing ambiguities and mis-implementations.

  http://seriot.ch/parsing_json.html

Food for thought...

--
Mark Nottingham   https://www.mnot.net/

---

From: Tim Bray <[email-masked]>
Date: Wed, 26 Oct 2016 18:18:17 -0700

​Note that I-JSON, RFC7493, is aimed at exactly his concerns.​

-- 
- Tim Bray (If you’d like to send me a private message, see
https://keybase.io/timbray)

---

From: Willy Tarreau <[email-masked]>
Date: Thu, 27 Oct 2016 07:30:46 +0200

>   http://seriot.ch/parsing_json.html

Thanks a lot for this link. I thought writing a JSON parser was easy, and
it seems that many implementers thought the same and were wrong as well!

Willy

---

From: "Poul-Henning Kamp" <[email-masked]>
Date: Thu, 27 Oct 2016 07:29:23 +0000

--------
In message <[email-masked]>, Mark Nottingham wri
tes:

>For those who haven't seen it, this is a pretty deep dive on JSON 
>parsing ambiguities and mis-implementations.
>

Add to that thought that we cannot even use JSON to begin with, because
of the restrictions on H1 headers...

-- 
Poul-Henning Kamp       | UNIX since Zilog Zeus 3.20
[email-masked]         | TCP/IP since RFC 956
FreeBSD committer       | BSD since 4.3-tahoe    
Never attribute to malice what can adequately be explained by incompetence.

---

From: Julian Reschke <[email-masked]>
Date: Thu, 27 Oct 2016 10:48:58 +0200

> ​Note that I-JSON, RFC7493, is aimed at exactly his concerns.​

Speaking of which: 
<https://tools.ietf.org/rfcdiff?url2=draft-ietf-httpbis-jfv-02.txt#part-4>.

Best regards, Julian

---

From: Julian Reschke <[email-masked]>
Date: Thu, 27 Oct 2016 10:49:40 +0200

> of the restrictions on H1 headers...

Sorry? Could you elaborate?

If we can't do it, why are people doing it successfully already?

---

From: "Poul-Henning Kamp" <[email-masked]>
Date: Thu, 27 Oct 2016 09:00:51 +0000

--------
In message <[email-masked]>, Julian Reschke writes
>Sorry? Could you elaborate?

"real" JSON can contain newlines

---

From: Julian Reschke <[email-masked]>
Date: Thu, 27 Oct 2016 11:05:02 +0200

> "real" JSON can contain newlines

Yes, but it's not relevant whether we can transport random JSON. What's 
relevant is that all JSON can be converted to something that can be 
safely transmitted in HTTP/1.1 header field values (and that is the case).

Best regards, Julian

---

From: "Poul-Henning Kamp" <[email-masked]>
Date: Thu, 27 Oct 2016 09:07:57 +0000

--------
In message <[email-masked]>, Julian Reschke writes

>safely transmitted in HTTP/1.1 header field values (and that is the case).

But then it is no longer JSON but "JSON with footnotes".

We can haggle about how many footnotes are necessary, or if they're
important, but there's no escaping that they will trip people up
and cause bugs and possibly security holes down the line.

---

From: Julian Reschke <[email-masked]>
Date: Thu, 27 Oct 2016 12:35:07 +0200

> and cause bugs and possibly security holes down the line.

Well, the conversion to field value notation is quite simple; see 
<https://greenbytes.de/tech/webdav/draft-ietf-httpbis-jfv-02.html#rfc.section.3>.

Best regards, Julian