ViewVC Help
View File | Revision Log | Show Annotations | Download File
/cvs/CBOR-XS/README
Revision: 1.9
Committed: Fri Nov 22 16:18:59 2013 UTC (10 years, 5 months ago) by root
Branch: MAIN
CVS Tags: rel-0_09
Changes since 1.8: +207 -27 lines
Log Message:
0.09

File Contents

# Content
1 NAME
2 CBOR::XS - Concise Binary Object Representation (CBOR, RFC7049)
3
4 SYNOPSIS
5 use CBOR::XS;
6
7 $binary_cbor_data = encode_cbor $perl_value;
8 $perl_value = decode_cbor $binary_cbor_data;
9
10 # OO-interface
11
12 $coder = CBOR::XS->new;
13 $binary_cbor_data = $coder->encode ($perl_value);
14 $perl_value = $coder->decode ($binary_cbor_data);
15
16 # prefix decoding
17
18 my $many_cbor_strings = ...;
19 while (length $many_cbor_strings) {
20 my ($data, $length) = $cbor->decode_prefix ($many_cbor_strings);
21 # data was decoded
22 substr $many_cbor_strings, 0, $length, ""; # remove decoded cbor string
23 }
24
25 DESCRIPTION
26 WARNING! This module is very new, and not very well tested (that's up to
27 you to do). Furthermore, details of the implementation might change
28 freely before version 1.0. And lastly, most extensions depend on an IANA
29 assignment, and until that assignment is official, this implementation
30 is not interoperable with other implementations (even future versions of
31 this module) until the assignment is done.
32
33 You are still invited to try out CBOR, and this module.
34
35 This module converts Perl data structures to the Concise Binary Object
36 Representation (CBOR) and vice versa. CBOR is a fast binary
37 serialisation format that aims to use a superset of the JSON data model,
38 i.e. when you can represent something in JSON, you should be able to
39 represent it in CBOR.
40
41 In short, CBOR is a faster and very compact binary alternative to JSON,
42 with the added ability of supporting serialisation of Perl objects.
43 (JSON often compresses better than CBOR though, so if you plan to
44 compress the data later you might want to compare both formats first).
45
46 To give you a general idea about speed, with texts in the megabyte
47 range, "CBOR::XS" usually encodes roughly twice as fast as Storable or
48 JSON::XS and decodes about 15%-30% faster than those. The shorter the
49 data, the worse Storable performs in comparison.
50
51 As for compactness, "CBOR::XS" encoded data structures are usually about
52 20% smaller than the same data encoded as (compact) JSON or Storable.
53
54 In addition to the core CBOR data format, this module implements a
55 number of extensions, to support cyclic and self-referencing data
56 structures (see "allow_sharing"), string deduplication (see
57 "allow_stringref") and scalar references (always enabled).
58
59 The primary goal of this module is to be *correct* and the secondary
60 goal is to be *fast*. To reach the latter goal it was written in C.
61
62 See MAPPING, below, on how CBOR::XS maps perl values to CBOR values and
63 vice versa.
64
65 FUNCTIONAL INTERFACE
66 The following convenience methods are provided by this module. They are
67 exported by default:
68
69 $cbor_data = encode_cbor $perl_scalar
70 Converts the given Perl data structure to CBOR representation.
71 Croaks on error.
72
73 $perl_scalar = decode_cbor $cbor_data
74 The opposite of "encode_cbor": expects a valid CBOR string to parse,
75 returning the resulting perl scalar. Croaks on error.
76
77 OBJECT-ORIENTED INTERFACE
78 The object oriented interface lets you configure your own encoding or
79 decoding style, within the limits of supported formats.
80
81 $cbor = new CBOR::XS
82 Creates a new CBOR::XS object that can be used to de/encode CBOR
83 strings. All boolean flags described below are by default
84 *disabled*.
85
86 The mutators for flags all return the CBOR object again and thus
87 calls can be chained:
88
89 my $cbor = CBOR::XS->new->encode ({a => [1,2]});
90
91 $cbor = $cbor->max_depth ([$maximum_nesting_depth])
92 $max_depth = $cbor->get_max_depth
93 Sets the maximum nesting level (default 512) accepted while encoding
94 or decoding. If a higher nesting level is detected in CBOR data or a
95 Perl data structure, then the encoder and decoder will stop and
96 croak at that point.
97
98 Nesting level is defined by number of hash- or arrayrefs that the
99 encoder needs to traverse to reach a given point or the number of
100 "{" or "[" characters without their matching closing parenthesis
101 crossed to reach a given character in a string.
102
103 Setting the maximum depth to one disallows any nesting, so that
104 ensures that the object is only a single hash/object or array.
105
106 If no argument is given, the highest possible setting will be used,
107 which is rarely useful.
108
109 Note that nesting is implemented by recursion in C. The default
110 value has been chosen to be as large as typical operating systems
111 allow without crashing.
112
113 See SECURITY CONSIDERATIONS, below, for more info on why this is
114 useful.
115
116 $cbor = $cbor->max_size ([$maximum_string_size])
117 $max_size = $cbor->get_max_size
118 Set the maximum length a CBOR string may have (in bytes) where
119 decoding is being attempted. The default is 0, meaning no limit.
120 When "decode" is called on a string that is longer then this many
121 bytes, it will not attempt to decode the string but throw an
122 exception. This setting has no effect on "encode" (yet).
123
124 If no argument is given, the limit check will be deactivated (same
125 as when 0 is specified).
126
127 See SECURITY CONSIDERATIONS, below, for more info on why this is
128 useful.
129
130 $cbor = $cbor->allow_unknown ([$enable])
131 $enabled = $cbor->get_allow_unknown
132 If $enable is true (or missing), then "encode" will *not* throw an
133 exception when it encounters values it cannot represent in CBOR (for
134 example, filehandles) but instead will encode a CBOR "error" value.
135
136 If $enable is false (the default), then "encode" will throw an
137 exception when it encounters anything it cannot encode as CBOR.
138
139 This option does not affect "decode" in any way, and it is
140 recommended to leave it off unless you know your communications
141 partner.
142
143 $cbor = $cbor->allow_sharing ([$enable])
144 $enabled = $cbor->get_allow_sharing
145 If $enable is true (or missing), then "encode" will not
146 double-encode values that have been referenced before (e.g. when the
147 same object, such as an array, is referenced multiple times), but
148 instead will emit a reference to the earlier value.
149
150 This means that such values will only be encoded once, and will not
151 result in a deep cloning of the value on decode, in decoders
152 supporting the value sharing extension.
153
154 It is recommended to leave it off unless you know your communication
155 partner supports the value sharing extensions to CBOR
156 (http://cbor.schmorp.de/value-sharing).
157
158 Detecting shared values incurs a runtime overhead when values are
159 encoded that have a reference counter large than one, and might
160 unnecessarily increase the encoded size, as potentially shared
161 values are encode as sharable whether or not they are actually
162 shared.
163
164 At the moment, only targets of references can be shared (e.g.
165 scalars, arrays or hashes pointed to by a reference). Weirder
166 constructs, such as an array with multiple "copies" of the *same*
167 string, which are hard but not impossible to create in Perl, are not
168 supported (this is the same as for Storable).
169
170 If $enable is false (the default), then "encode" will encode
171 exception when it encounters anything it cannot encode as CBOR.
172
173 This option does not affect "decode" in any way - shared values and
174 references will always be decoded properly if present.
175
176 $cbor = $cbor->allow_stringref ([$enable])
177 $enabled = $cbor->get_allow_stringref
178 If $enable is true (or missing), then "encode" will try not to
179 encode the same string twice, but will instead encode a reference to
180 the string instead. Depending on your data format. this can save a
181 lot of space, but also results in a very large runtime overhead
182 (expect encoding times to be 2-4 times as high as without).
183
184 It is recommended to leave it off unless you know your
185 communications partner supports the stringref extension to CBOR
186 (http://cbor.schmorp.de/stringref).
187
188 If $enable is false (the default), then "encode" will encode
189 exception when it encounters anything it cannot encode as CBOR.
190
191 This option does not affect "decode" in any way - string references
192 will always be decoded properly if present.
193
194 $cbor = $cbor->filter ([$cb->($tag, $value)])
195 $cb_or_undef = $cbor->get_filter
196 Sets or replaces the tagged value decoding filter (when $cb is
197 specified) or clears the filter (if no argument or "undef" is
198 provided).
199
200 The filter callback is called only during decoding, when a
201 non-enforced tagged value has been decoded (see "TAG HANDLING AND
202 EXTENSIONS" for a list of enforced tags). For specific tags, it's
203 often better to provide a default converter using the
204 %CBOR::XS::FILTER hash (see below).
205
206 The first argument is the numerical tag, the second is the (decoded)
207 value that has been tagged.
208
209 The filter function should return either exactly one value, which
210 will replace the tagged value in the decoded data structure, or no
211 values, which will result in default handling, which currently means
212 the decoder creates a "CBOR::XS::Tagged" object to hold the tag and
213 the value.
214
215 When the filter is cleared (the default state), the default filter
216 function, "CBOR::XS::default_filter", is used. This function simply
217 looks up the tag in the %CBOR::XS::FILTER hash. If an entry exists
218 it must be a code reference that is called with tag and value, and
219 is responsible for decoding the value. If no entry exists, it
220 returns no values.
221
222 Example: decode all tags not handled internally into
223 CBOR::XS::Tagged objects, with no other special handling (useful
224 when working with potentially "unsafe" CBOR data).
225
226 CBOR::XS->new->filter (sub { })->decode ($cbor_data);
227
228 Example: provide a global filter for tag 1347375694, converting the
229 value into some string form.
230
231 $CBOR::XS::FILTER{1347375694} = sub {
232 my ($tag, $value);
233
234 "tag 1347375694 value $value"
235 };
236
237 $cbor_data = $cbor->encode ($perl_scalar)
238 Converts the given Perl data structure (a scalar value) to its CBOR
239 representation.
240
241 $perl_scalar = $cbor->decode ($cbor_data)
242 The opposite of "encode": expects CBOR data and tries to parse it,
243 returning the resulting simple scalar or reference. Croaks on error.
244
245 ($perl_scalar, $octets) = $cbor->decode_prefix ($cbor_data)
246 This works like the "decode" method, but instead of raising an
247 exception when there is trailing garbage after the CBOR string, it
248 will silently stop parsing there and return the number of characters
249 consumed so far.
250
251 This is useful if your CBOR texts are not delimited by an outer
252 protocol and you need to know where the first CBOR string ends amd
253 the next one starts.
254
255 CBOR::XS->new->decode_prefix ("......")
256 => ("...", 3)
257
258 MAPPING
259 This section describes how CBOR::XS maps Perl values to CBOR values and
260 vice versa. These mappings are designed to "do the right thing" in most
261 circumstances automatically, preserving round-tripping characteristics
262 (what you put in comes out as something equivalent).
263
264 For the more enlightened: note that in the following descriptions,
265 lowercase *perl* refers to the Perl interpreter, while uppercase *Perl*
266 refers to the abstract Perl language itself.
267
268 CBOR -> PERL
269 integers
270 CBOR integers become (numeric) perl scalars. On perls without 64 bit
271 support, 64 bit integers will be truncated or otherwise corrupted.
272
273 byte strings
274 Byte strings will become octet strings in Perl (the byte values
275 0..255 will simply become characters of the same value in Perl).
276
277 UTF-8 strings
278 UTF-8 strings in CBOR will be decoded, i.e. the UTF-8 octets will be
279 decoded into proper Unicode code points. At the moment, the validity
280 of the UTF-8 octets will not be validated - corrupt input will
281 result in corrupted Perl strings.
282
283 arrays, maps
284 CBOR arrays and CBOR maps will be converted into references to a
285 Perl array or hash, respectively. The keys of the map will be
286 stringified during this process.
287
288 null
289 CBOR null becomes "undef" in Perl.
290
291 true, false, undefined
292 These CBOR values become "Types:Serialiser::true",
293 "Types:Serialiser::false" and "Types::Serialiser::error",
294 respectively. They are overloaded to act almost exactly like the
295 numbers 1 and 0 (for true and false) or to throw an exception on
296 access (for error). See the Types::Serialiser manpage for details.
297
298 tagged values
299 Tagged items consists of a numeric tag and another CBOR value.
300
301 See "TAG HANDLING AND EXTENSIONS" and the description of "->filter"
302 for details.
303
304 anything else
305 Anything else (e.g. unsupported simple values) will raise a decoding
306 error.
307
308 PERL -> CBOR
309 The mapping from Perl to CBOR is slightly more difficult, as Perl is a
310 truly typeless language, so we can only guess which CBOR type is meant
311 by a Perl value.
312
313 hash references
314 Perl hash references become CBOR maps. As there is no inherent
315 ordering in hash keys (or CBOR maps), they will usually be encoded
316 in a pseudo-random order.
317
318 Currently, tied hashes will use the indefinite-length format, while
319 normal hashes will use the fixed-length format.
320
321 array references
322 Perl array references become fixed-length CBOR arrays.
323
324 other references
325 Other unblessed references are generally not allowed and will cause
326 an exception to be thrown, except for references to the integers 0
327 and 1, which get turned into false and true in CBOR.
328
329 CBOR::XS::Tagged objects
330 Objects of this type must be arrays consisting of a single "[tag,
331 value]" pair. The (numerical) tag will be encoded as a CBOR tag, the
332 value will be encoded as appropriate for the value. You cna use
333 "CBOR::XS::tag" to create such objects.
334
335 Types::Serialiser::true, Types::Serialiser::false,
336 Types::Serialiser::error
337 These special values become CBOR true, CBOR false and CBOR undefined
338 values, respectively. You can also use "\1", "\0" and "\undef"
339 directly if you want.
340
341 other blessed objects
342 Other blessed objects are serialised via "TO_CBOR" or "FREEZE". See
343 "TAG HANDLING AND EXTENSIONS" for specific classes handled by this
344 module, and "OBJECT SERIALISATION" for generic object serialisation.
345
346 simple scalars
347 Simple Perl scalars (any scalar that is not a reference) are the
348 most difficult objects to encode: CBOR::XS will encode undefined
349 scalars as CBOR null values, scalars that have last been used in a
350 string context before encoding as CBOR strings, and anything else as
351 number value:
352
353 # dump as number
354 encode_cbor [2] # yields [2]
355 encode_cbor [-3.0e17] # yields [-3e+17]
356 my $value = 5; encode_cbor [$value] # yields [5]
357
358 # used as string, so dump as string
359 print $value;
360 encode_cbor [$value] # yields ["5"]
361
362 # undef becomes null
363 encode_cbor [undef] # yields [null]
364
365 You can force the type to be a CBOR string by stringifying it:
366
367 my $x = 3.1; # some variable containing a number
368 "$x"; # stringified
369 $x .= ""; # another, more awkward way to stringify
370 print $x; # perl does it for you, too, quite often
371
372 You can force the type to be a CBOR number by numifying it:
373
374 my $x = "3"; # some variable containing a string
375 $x += 0; # numify it, ensuring it will be dumped as a number
376 $x *= 1; # same thing, the choice is yours.
377
378 You can not currently force the type in other, less obscure, ways.
379 Tell me if you need this capability (but don't forget to explain why
380 it's needed :).
381
382 Perl values that seem to be integers generally use the shortest
383 possible representation. Floating-point values will use either the
384 IEEE single format if possible without loss of precision, otherwise
385 the IEEE double format will be used. Perls that use formats other
386 than IEEE double to represent numerical values are supported, but
387 might suffer loss of precision.
388
389 OBJECT SERIALISATION
390 This module knows two way to serialise a Perl object: The CBOR-specific
391 way, and the generic way.
392
393 Whenever the encoder encounters a Perl object that it cnanot serialise
394 directly (most of them), it will first look up the "TO_CBOR" method on
395 it.
396
397 If it has a "TO_CBOR" method, it will call it with the object as only
398 argument, and expects exactly one return value, which it will then
399 substitute and encode it in the place of the object.
400
401 Otherwise, it will look up the "FREEZE" method. If it exists, it will
402 call it with the object as first argument, and the constant string
403 "CBOR" as the second argument, to distinguish it from other serialisers.
404
405 The "FREEZE" method can return any number of values (i.e. zero or more).
406 These will be encoded as CBOR perl object, together with the classname.
407
408 If an object supports neither "TO_CBOR" nor "FREEZE", encoding will fail
409 with an error.
410
411 Objects encoded via "TO_CBOR" cannot be automatically decoded, but
412 objects encoded via "FREEZE" can be decoded using the following
413 protocol:
414
415 When an encoded CBOR perl object is encountered by the decoder, it will
416 look up the "THAW" method, by using the stored classname, and will fail
417 if the method cannot be found.
418
419 After the lookup it will call the "THAW" method with the stored
420 classname as first argument, the constant string "CBOR" as second
421 argument, and all values returned by "FREEZE" as remaining arguments.
422
423 EXAMPLES
424 Here is an example "TO_CBOR" method:
425
426 sub My::Object::TO_CBOR {
427 my ($obj) = @_;
428
429 ["this is a serialised My::Object object", $obj->{id}]
430 }
431
432 When a "My::Object" is encoded to CBOR, it will instead encode a simple
433 array with two members: a string, and the "object id". Decoding this
434 CBOR string will yield a normal perl array reference in place of the
435 object.
436
437 A more useful and practical example would be a serialisation method for
438 the URI module. CBOR has a custom tag value for URIs, namely 32:
439
440 sub URI::TO_CBOR {
441 my ($self) = @_;
442 my $uri = "$self"; # stringify uri
443 utf8::upgrade $uri; # make sure it will be encoded as UTF-8 string
444 CBOR::XS::tagged 32, "$_[0]"
445 }
446
447 This will encode URIs as a UTF-8 string with tag 32, which indicates an
448 URI.
449
450 Decoding such an URI will not (currently) give you an URI object, but
451 instead a CBOR::XS::Tagged object with tag number 32 and the string -
452 exactly what was returned by "TO_CBOR".
453
454 To serialise an object so it can automatically be deserialised, you need
455 to use "FREEZE" and "THAW". To take the URI module as example, this
456 would be a possible implementation:
457
458 sub URI::FREEZE {
459 my ($self, $serialiser) = @_;
460 "$self" # encode url string
461 }
462
463 sub URI::THAW {
464 my ($class, $serialiser, $uri) = @_;
465
466 $class->new ($uri)
467 }
468
469 Unlike "TO_CBOR", multiple values can be returned by "FREEZE". For
470 example, a "FREEZE" method that returns "type", "id" and "variant"
471 values would cause an invocation of "THAW" with 5 arguments:
472
473 sub My::Object::FREEZE {
474 my ($self, $serialiser) = @_;
475
476 ($self->{type}, $self->{id}, $self->{variant})
477 }
478
479 sub My::Object::THAW {
480 my ($class, $serialiser, $type, $id, $variant) = @_;
481
482 $class-<new (type => $type, id => $id, variant => $variant)
483 }
484
485 MAGIC HEADER
486 There is no way to distinguish CBOR from other formats programmatically.
487 To make it easier to distinguish CBOR from other formats, the CBOR
488 specification has a special "magic string" that can be prepended to any
489 CBOR string without changing its meaning.
490
491 This string is available as $CBOR::XS::MAGIC. This module does not
492 prepend this string to the CBOR data it generates, but it will ignore it
493 if present, so users can prepend this string as a "file type" indicator
494 as required.
495
496 THE CBOR::XS::Tagged CLASS
497 CBOR has the concept of tagged values - any CBOR value can be tagged
498 with a numeric 64 bit number, which are centrally administered.
499
500 "CBOR::XS" handles a few tags internally when en- or decoding. You can
501 also create tags yourself by encoding "CBOR::XS::Tagged" objects, and
502 the decoder will create "CBOR::XS::Tagged" objects itself when it hits
503 an unknown tag.
504
505 These objects are simply blessed array references - the first member of
506 the array being the numerical tag, the second being the value.
507
508 You can interact with "CBOR::XS::Tagged" objects in the following ways:
509
510 $tagged = CBOR::XS::tag $tag, $value
511 This function(!) creates a new "CBOR::XS::Tagged" object using the
512 given $tag (0..2**64-1) to tag the given $value (which can be any
513 Perl value that can be encoded in CBOR, including serialisable Perl
514 objects and "CBOR::XS::Tagged" objects).
515
516 $tagged->[0]
517 $tagged->[0] = $new_tag
518 $tag = $tagged->tag
519 $new_tag = $tagged->tag ($new_tag)
520 Access/mutate the tag.
521
522 $tagged->[1]
523 $tagged->[1] = $new_value
524 $value = $tagged->value
525 $new_value = $tagged->value ($new_value)
526 Access/mutate the tagged value.
527
528 EXAMPLES
529 Here are some examples of "CBOR::XS::Tagged" uses to tag objects.
530
531 You can look up CBOR tag value and emanings in the IANA registry at
532 <http://www.iana.org/assignments/cbor-tags/cbor-tags.xhtml>.
533
534 Prepend a magic header ($CBOR::XS::MAGIC):
535
536 my $cbor = encode_cbor CBOR::XS::tag 55799, $value;
537 # same as:
538 my $cbor = $CBOR::XS::MAGIC . encode_cbor $value;
539
540 Serialise some URIs and a regex in an array:
541
542 my $cbor = encode_cbor [
543 (CBOR::XS::tag 32, "http://www.nethype.de/"),
544 (CBOR::XS::tag 32, "http://software.schmorp.de/"),
545 (CBOR::XS::tag 35, "^[Pp][Ee][Rr][lL]\$"),
546 ];
547
548 Wrap CBOR data in CBOR:
549
550 my $cbor_cbor = encode_cbor
551 CBOR::XS::tag 24,
552 encode_cbor [1, 2, 3];
553
554 TAG HANDLING AND EXTENSIONS
555 This section describes how this module handles specific tagged values
556 and extensions. If a tag is not mentioned here and no additional filters
557 are provided for it, then the default handling applies (creating a
558 CBOR::XS::Tagged object on decoding, and only encoding the tag when
559 explicitly requested).
560
561 Tags not handled specifically are currently converted into a
562 CBOR::XS::Tagged object, which is simply a blessed array reference
563 consisting of the numeric tag value followed by the (decoded) CBOR
564 value.
565
566 Future versions of this module reserve the right to special case
567 additional tags (such as base64url).
568
569 ENFORCED TAGS
570 These tags are always handled when decoding, and their handling cannot
571 be overriden by the user.
572
573 <unassigned> (perl-object, <http://cbor.schmorp.de/perl-object>)
574 These tags are automatically created (and decoded) for serialisable
575 objects using the "FREEZE/THAW" methods (the Types::Serialier object
576 serialisation protocol). See "OBJECT SERIALISATION" for details.
577
578 <unassigned>, <unassigned> (sharable, sharedref, L
579 <http://cbor.schmorp.de/value-sharing>)
580 These tags are automatically decoded when encountered, resulting in
581 shared values in the decoded object. They are only encoded, however,
582 when "allow_sharable" is enabled.
583
584 <unassigned>, <unassigned> (stringref-namespace, stringref, L
585 <http://cbor.schmorp.de/stringref>)
586 These tags are automatically decoded when encountered. They are only
587 encoded, however, when "allow_stringref" is enabled.
588
589 22098 (indirection, <http://cbor.schmorp.de/indirection>)
590 This tag is automatically generated when a reference are encountered
591 (with the exception of hash and array refernces). It is converted to
592 a reference when decoding.
593
594 55799 (self-describe CBOR, RFC 7049)
595 This value is not generated on encoding (unless explicitly requested
596 by the user), and is simply ignored when decoding.
597
598 NON-ENFORCED TAGS
599 These tags have default filters provided when decoding. Their handling
600 can be overriden by changing the %CBOR::XS::FILTER entry for the tag, or
601 by providing a custom "filter" callback when decoding.
602
603 When they result in decoding into a specific Perl class, the module
604 usually provides a corresponding "TO_CBOR" method as well.
605
606 When any of these need to load additional modules that are not part of
607 the perl core distribution (e.g. URI), it is (currently) up to the user
608 to provide these modules. The decoding usually fails with an exception
609 if the required module cannot be loaded.
610
611 2, 3 (positive/negative bignum)
612 These tags are decoded into Math::BigInt objects. The corresponding
613 "Math::BigInt::TO_CBOR" method encodes "small" bigints into normal
614 CBOR integers, and others into positive/negative CBOR bignums.
615
616 4, 5 (decimal fraction/bigfloat)
617 Both decimal fractions and bigfloats are decoded into Math::BigFloat
618 objects. The corresponding "Math::BigFloat::TO_CBOR" method *always*
619 encodes into a decimal fraction.
620
621 CBOR cannot represent bigfloats with *very* large exponents -
622 conversion of such big float objects is undefined.
623
624 Also, NaN and infinities are not encoded properly.
625
626 21, 22, 23 (expected later JSON conversion)
627 CBOR::XS is not a CBOR-to-JSON converter, and will simply ignore
628 these tags.
629
630 32 (URI)
631 These objects decode into URI objects. The corresponding
632 "URI::TO_CBOR" method again results in a CBOR URI value.
633
634 CBOR and JSON
635 CBOR is supposed to implement a superset of the JSON data model, and is,
636 with some coercion, able to represent all JSON texts (something that
637 other "binary JSON" formats such as BSON generally do not support).
638
639 CBOR implements some extra hints and support for JSON interoperability,
640 and the spec offers further guidance for conversion between CBOR and
641 JSON. None of this is currently implemented in CBOR, and the guidelines
642 in the spec do not result in correct round-tripping of data. If JSON
643 interoperability is improved in the future, then the goal will be to
644 ensure that decoded JSON data will round-trip encoding and decoding to
645 CBOR intact.
646
647 SECURITY CONSIDERATIONS
648 When you are using CBOR in a protocol, talking to untrusted potentially
649 hostile creatures requires relatively few measures.
650
651 First of all, your CBOR decoder should be secure, that is, should not
652 have any buffer overflows. Obviously, this module should ensure that and
653 I am trying hard on making that true, but you never know.
654
655 Second, you need to avoid resource-starving attacks. That means you
656 should limit the size of CBOR data you accept, or make sure then when
657 your resources run out, that's just fine (e.g. by using a separate
658 process that can crash safely). The size of a CBOR string in octets is
659 usually a good indication of the size of the resources required to
660 decode it into a Perl structure. While CBOR::XS can check the size of
661 the CBOR text, it might be too late when you already have it in memory,
662 so you might want to check the size before you accept the string.
663
664 Third, CBOR::XS recurses using the C stack when decoding objects and
665 arrays. The C stack is a limited resource: for instance, on my amd64
666 machine with 8MB of stack size I can decode around 180k nested arrays
667 but only 14k nested CBOR objects (due to perl itself recursing deeply on
668 croak to free the temporary). If that is exceeded, the program crashes.
669 To be conservative, the default nesting limit is set to 512. If your
670 process has a smaller stack, you should adjust this setting accordingly
671 with the "max_depth" method.
672
673 Something else could bomb you, too, that I forgot to think of. In that
674 case, you get to keep the pieces. I am always open for hints, though...
675
676 Also keep in mind that CBOR::XS might leak contents of your Perl data
677 structures in its error messages, so when you serialise sensitive
678 information you might want to make sure that exceptions thrown by
679 CBOR::XS will not end up in front of untrusted eyes.
680
681 CBOR IMPLEMENTATION NOTES
682 This section contains some random implementation notes. They do not
683 describe guaranteed behaviour, but merely behaviour as-is implemented
684 right now.
685
686 64 bit integers are only properly decoded when Perl was built with 64
687 bit support.
688
689 Strings and arrays are encoded with a definite length. Hashes as well,
690 unless they are tied (or otherwise magical).
691
692 Only the double data type is supported for NV data types - when Perl
693 uses long double to represent floating point values, they might not be
694 encoded properly. Half precision types are accepted, but not encoded.
695
696 Strict mode and canonical mode are not implemented.
697
698 THREADS
699 This module is *not* guaranteed to be thread safe and there are no plans
700 to change this until Perl gets thread support (as opposed to the
701 horribly slow so-called "threads" which are simply slow and bloated
702 process simulations - use fork, it's *much* faster, cheaper, better).
703
704 (It might actually work, but you have been warned).
705
706 BUGS
707 While the goal of this module is to be correct, that unfortunately does
708 not mean it's bug-free, only that I think its design is bug-free. If you
709 keep reporting bugs they will be fixed swiftly, though.
710
711 Please refrain from using rt.cpan.org or any other bug reporting
712 service. I put the contact address into my modules for a reason.
713
714 SEE ALSO
715 The JSON and JSON::XS modules that do similar, but human-readable,
716 serialisation.
717
718 The Types::Serialiser module provides the data model for true, false and
719 error values.
720
721 AUTHOR
722 Marc Lehmann <schmorp@schmorp.de>
723 http://home.schmorp.de/
724