ViewVC Help
View File | Revision Log | Show Annotations | Download File
/cvs/JSON-XS/README
(Generate patch)

Comparing JSON-XS/README (file contents):
Revision 1.10 by root, Wed Apr 4 00:01:44 2007 UTC vs.
Revision 1.17 by root, Mon Aug 27 02:03:23 2007 UTC

7 # exported functions, they croak on error 7 # exported functions, they croak on error
8 # and expect/generate UTF-8 8 # and expect/generate UTF-8
9 9
10 $utf8_encoded_json_text = to_json $perl_hash_or_arrayref; 10 $utf8_encoded_json_text = to_json $perl_hash_or_arrayref;
11 $perl_hash_or_arrayref = from_json $utf8_encoded_json_text; 11 $perl_hash_or_arrayref = from_json $utf8_encoded_json_text;
12
13 # objToJson and jsonToObj aliases to to_json and from_json
14 # are exported for compatibility to the JSON module,
15 # but should not be used in new code.
16 12
17 # OO-interface 13 # OO-interface
18 14
19 $coder = JSON::XS->new->ascii->pretty->allow_nonref; 15 $coder = JSON::XS->new->ascii->pretty->allow_nonref;
20 $pretty_printed_unencoded = $coder->encode ($perl_scalar); 16 $pretty_printed_unencoded = $coder->encode ($perl_scalar);
92 88
93 $perl_scalar = JSON::XS->new->utf8->decode ($json_text) 89 $perl_scalar = JSON::XS->new->utf8->decode ($json_text)
94 90
95 except being faster. 91 except being faster.
96 92
93 $is_boolean = JSON::XS::is_bool $scalar
94 Returns true if the passed scalar represents either JSON::XS::true
95 or JSON::XS::false, two constants that act like 1 and 0,
96 respectively and are used to represent JSON "true" and "false"
97 values in Perl.
98
99 See MAPPING, below, for more information on how JSON values are
100 mapped to Perl.
101
97OBJECT-ORIENTED INTERFACE 102OBJECT-ORIENTED INTERFACE
98 The object oriented interface lets you configure your own encoding or 103 The object oriented interface lets you configure your own encoding or
99 decoding style, within the limits of supported formats. 104 decoding style, within the limits of supported formats.
100 105
101 $json = new JSON::XS 106 $json = new JSON::XS
112 $json = $json->ascii ([$enable]) 117 $json = $json->ascii ([$enable])
113 If $enable is true (or missing), then the "encode" method will not 118 If $enable is true (or missing), then the "encode" method will not
114 generate characters outside the code range 0..127 (which is ASCII). 119 generate characters outside the code range 0..127 (which is ASCII).
115 Any unicode characters outside that range will be escaped using 120 Any unicode characters outside that range will be escaped using
116 either a single \uXXXX (BMP characters) or a double \uHHHH\uLLLLL 121 either a single \uXXXX (BMP characters) or a double \uHHHH\uLLLLL
117 escape sequence, as per RFC4627. 122 escape sequence, as per RFC4627. The resulting encoded JSON text can
123 be treated as a native unicode string, an ascii-encoded,
124 latin1-encoded or UTF-8 encoded string, or any other superset of
125 ASCII.
118 126
119 If $enable is false, then the "encode" method will not escape 127 If $enable is false, then the "encode" method will not escape
120 Unicode characters unless required by the JSON syntax. This results 128 Unicode characters unless required by the JSON syntax or other
121 in a faster and more compact format. 129 flags. This results in a faster and more compact format.
130
131 The main use for this flag is to produce JSON texts that can be
132 transmitted over a 7-bit channel, as the encoded JSON texts will not
133 contain any 8 bit characters.
122 134
123 JSON::XS->new->ascii (1)->encode ([chr 0x10401]) 135 JSON::XS->new->ascii (1)->encode ([chr 0x10401])
124 => ["\ud801\udc01"] 136 => ["\ud801\udc01"]
137
138 $json = $json->latin1 ([$enable])
139 If $enable is true (or missing), then the "encode" method will
140 encode the resulting JSON text as latin1 (or iso-8859-1), escaping
141 any characters outside the code range 0..255. The resulting string
142 can be treated as a latin1-encoded JSON text or a native unicode
143 string. The "decode" method will not be affected in any way by this
144 flag, as "decode" by default expects unicode, which is a strict
145 superset of latin1.
146
147 If $enable is false, then the "encode" method will not escape
148 Unicode characters unless required by the JSON syntax or other
149 flags.
150
151 The main use for this flag is efficiently encoding binary data as
152 JSON text, as most octets will not be escaped, resulting in a
153 smaller encoded size. The disadvantage is that the resulting JSON
154 text is encoded in latin1 (and must correctly be treated as such
155 when storing and transfering), a rare encoding for JSON. It is
156 therefore most useful when you want to store data structures known
157 to contain binary data efficiently in files or databases, not when
158 talking to other JSON encoders/decoders.
159
160 JSON::XS->new->latin1->encode (["\x{89}\x{abc}"]
161 => ["\x{89}\\u0abc"] # (perl syntax, U+abc escaped, U+89 not)
125 162
126 $json = $json->utf8 ([$enable]) 163 $json = $json->utf8 ([$enable])
127 If $enable is true (or missing), then the "encode" method will 164 If $enable is true (or missing), then the "encode" method will
128 encode the JSON result into UTF-8, as required by many protocols, 165 encode the JSON result into UTF-8, as required by many protocols,
129 while the "decode" method expects to be handled an UTF-8-encoded 166 while the "decode" method expects to be handled an UTF-8-encoded
203 240
204 Example, space_before and indent disabled, space_after enabled: 241 Example, space_before and indent disabled, space_after enabled:
205 242
206 {"key": "value"} 243 {"key": "value"}
207 244
245 $json = $json->relaxed ([$enable])
246 If $enable is true (or missing), then "decode" will accept some
247 extensions to normal JSON syntax (see below). "encode" will not be
248 affected in anyway. *Be aware that this option makes you accept
249 invalid JSON texts as if they were valid!*. I suggest only to use
250 this option to parse application-specific files written by humans
251 (configuration files, resource files etc.)
252
253 If $enable is false (the default), then "decode" will only accept
254 valid JSON texts.
255
256 Currently accepted extensions are:
257
258 * list items can have an end-comma
259 JSON *separates* array elements and key-value pairs with commas.
260 This can be annoying if you write JSON texts manually and want
261 to be able to quickly append elements, so this extension accepts
262 comma at the end of such items not just between them:
263
264 [
265 1,
266 2, <- this comma not normally allowed
267 ]
268 {
269 "k1": "v1",
270 "k2": "v2", <- this comma not normally allowed
271 }
272
208 $json = $json->canonical ([$enable]) 273 $json = $json->canonical ([$enable])
209 If $enable is true (or missing), then the "encode" method will 274 If $enable is true (or missing), then the "encode" method will
210 output JSON objects by sorting their keys. This is adding a 275 output JSON objects by sorting their keys. This is adding a
211 comparatively high overhead. 276 comparatively high overhead.
212 277
236 Example, encode a Perl scalar as JSON value with enabled 301 Example, encode a Perl scalar as JSON value with enabled
237 "allow_nonref", resulting in an invalid JSON text: 302 "allow_nonref", resulting in an invalid JSON text:
238 303
239 JSON::XS->new->allow_nonref->encode ("Hello, World!") 304 JSON::XS->new->allow_nonref->encode ("Hello, World!")
240 => "Hello, World!" 305 => "Hello, World!"
306
307 $json = $json->allow_blessed ([$enable])
308 If $enable is true (or missing), then the "encode" method will not
309 barf when it encounters a blessed reference. Instead, the value of
310 the convert_blessed option will decide wether "null"
311 ("convert_blessed" disabled or no "to_json" method found) or a
312 representation of the object ("convert_blessed" enabled and
313 "to_json" method found) is being encoded. Has no effect on "decode".
314
315 If $enable is false (the default), then "encode" will throw an
316 exception when it encounters a blessed object.
317
318 $json = $json->convert_blessed ([$enable])
319 If $enable is true (or missing), then "encode", upon encountering a
320 blessed object, will check for the availability of the "TO_JSON"
321 method on the object's class. If found, it will be called in scalar
322 context and the resulting scalar will be encoded instead of the
323 object. If no "TO_JSON" method is found, the value of
324 "allow_blessed" will decide what to do.
325
326 The "TO_JSON" method may safely call die if it wants. If "TO_JSON"
327 returns other blessed objects, those will be handled in the same
328 way. "TO_JSON" must take care of not causing an endless recursion
329 cycle (== crash) in this case. The name of "TO_JSON" was chosen
330 because other methods called by the Perl core (== not by the user of
331 the object) are usually in upper case letters and to avoid
332 collisions with the "to_json" function.
333
334 This setting does not yet influence "decode" in any way, but in the
335 future, global hooks might get installed that influence "decode" and
336 are enabled by this setting.
337
338 If $enable is false, then the "allow_blessed" setting will decide
339 what to do when a blessed object is found.
340
341 $json = $json->filter_json_object ([$coderef->($hashref)])
342 When $coderef is specified, it will be called from "decode" each
343 time it decodes a JSON object. The only argument is a reference to
344 the newly-created hash. If the code references returns a single
345 scalar (which need not be a reference), this value (i.e. a copy of
346 that scalar to avoid aliasing) is inserted into the deserialised
347 data structure. If it returns an empty list (NOTE: *not* "undef",
348 which is a valid scalar), the original deserialised hash will be
349 inserted. This setting can slow down decoding considerably.
350
351 When $coderef is omitted or undefined, any existing callback will be
352 removed and "decode" will not change the deserialised hash in any
353 way.
354
355 Example, convert all JSON objects into the integer 5:
356
357 my $js = JSON::XS->new->filter_json_object (sub { 5 });
358 # returns [5]
359 $js->decode ('[{}]')
360 # throw an exception because allow_nonref is not enabled
361 # so a lone 5 is not allowed.
362 $js->decode ('{"a":1, "b":2}');
363
364 $json = $json->filter_json_single_key_object ($key [=>
365 $coderef->($value)])
366 Works remotely similar to "filter_json_object", but is only called
367 for JSON objects having a single key named $key.
368
369 This $coderef is called before the one specified via
370 "filter_json_object", if any. It gets passed the single value in the
371 JSON object. If it returns a single value, it will be inserted into
372 the data structure. If it returns nothing (not even "undef" but the
373 empty list), the callback from "filter_json_object" will be called
374 next, as if no single-key callback were specified.
375
376 If $coderef is omitted or undefined, the corresponding callback will
377 be disabled. There can only ever be one callback for a given key.
378
379 As this callback gets called less often then the
380 "filter_json_object" one, decoding speed will not usually suffer as
381 much. Therefore, single-key objects make excellent targets to
382 serialise Perl objects into, especially as single-key JSON objects
383 are as close to the type-tagged value concept as JSON gets (its
384 basically an ID/VALUE tuple). Of course, JSON does not support this
385 in any way, so you need to make sure your data never looks like a
386 serialised Perl hash.
387
388 Typical names for the single object key are "__class_whatever__", or
389 "$__dollars_are_rarely_used__$" or "}ugly_brace_placement", or even
390 things like "__class_md5sum(classname)__", to reduce the risk of
391 clashing with real hashes.
392
393 Example, decode JSON objects of the form "{ "__widget__" => <id> }"
394 into the corresponding $WIDGET{<id>} object:
395
396 # return whatever is in $WIDGET{5}:
397 JSON::XS
398 ->new
399 ->filter_json_single_key_object (__widget__ => sub {
400 $WIDGET{ $_[0] }
401 })
402 ->decode ('{"__widget__": 5')
403
404 # this can be used with a TO_JSON method in some "widget" class
405 # for serialisation to json:
406 sub WidgetBase::TO_JSON {
407 my ($self) = @_;
408
409 unless ($self->{id}) {
410 $self->{id} = ..get..some..id..;
411 $WIDGET{$self->{id}} = $self;
412 }
413
414 { __widget__ => $self->{id} }
415 }
241 416
242 $json = $json->shrink ([$enable]) 417 $json = $json->shrink ([$enable])
243 Perl usually over-allocates memory a bit when allocating space for 418 Perl usually over-allocates memory a bit when allocating space for
244 strings. This flag optionally resizes strings generated by either 419 strings. This flag optionally resizes strings generated by either
245 "encode" or "decode" to their minimum size possible. This can save 420 "encode" or "decode" to their minimum size possible. This can save
278 crossed to reach a given character in a string. 453 crossed to reach a given character in a string.
279 454
280 Setting the maximum depth to one disallows any nesting, so that 455 Setting the maximum depth to one disallows any nesting, so that
281 ensures that the object is only a single hash/object or array. 456 ensures that the object is only a single hash/object or array.
282 457
283 The argument to "max_depth" will be rounded up to the next nearest 458 The argument to "max_depth" will be rounded up to the next highest
284 power of two. 459 power of two. If no argument is given, the highest possible setting
460 will be used, which is rarely useful.
461
462 See SECURITY CONSIDERATIONS, below, for more info on why this is
463 useful.
464
465 $json = $json->max_size ([$maximum_string_size])
466 Set the maximum length a JSON text may have (in bytes) where
467 decoding is being attempted. The default is 0, meaning no limit.
468 When "decode" is called on a string longer then this number of
469 characters it will not attempt to decode the string but throw an
470 exception. This setting has no effect on "encode" (yet).
471
472 The argument to "max_size" will be rounded up to the next highest
473 power of two (so may be more than requested). If no argument is
474 given, the limit check will be deactivated (same as when 0 is
475 specified).
285 476
286 See SECURITY CONSIDERATIONS, below, for more info on why this is 477 See SECURITY CONSIDERATIONS, below, for more info on why this is
287 useful. 478 useful.
288 479
289 $json_text = $json->encode ($perl_scalar) 480 $json_text = $json->encode ($perl_scalar)
301 492
302 JSON numbers and strings become simple Perl scalars. JSON arrays 493 JSON numbers and strings become simple Perl scalars. JSON arrays
303 become Perl arrayrefs and JSON objects become Perl hashrefs. "true" 494 become Perl arrayrefs and JSON objects become Perl hashrefs. "true"
304 becomes 1, "false" becomes 0 and "null" becomes "undef". 495 becomes 1, "false" becomes 0 and "null" becomes "undef".
305 496
497 ($perl_scalar, $characters) = $json->decode_prefix ($json_text)
498 This works like the "decode" method, but instead of raising an
499 exception when there is trailing garbage after the first JSON
500 object, it will silently stop parsing there and return the number of
501 characters consumed so far.
502
503 This is useful if your JSON texts are not delimited by an outer
504 protocol (which is not the brightest thing to do in the first place)
505 and you need to know where the JSON text ends.
506
507 JSON::XS->new->decode_prefix ("[1] the tail")
508 => ([], 3)
509
306MAPPING 510MAPPING
307 This section describes how JSON::XS maps Perl values to JSON values and 511 This section describes how JSON::XS maps Perl values to JSON values and
308 vice versa. These mappings are designed to "do the right thing" in most 512 vice versa. These mappings are designed to "do the right thing" in most
309 circumstances automatically, preserving round-tripping characteristics 513 circumstances automatically, preserving round-tripping characteristics
310 (what you put in comes out as something equivalent). 514 (what you put in comes out as something equivalent).
326 A JSON string becomes a string scalar in Perl - Unicode codepoints 530 A JSON string becomes a string scalar in Perl - Unicode codepoints
327 in JSON are represented by the same codepoints in the Perl string, 531 in JSON are represented by the same codepoints in the Perl string,
328 so no manual decoding is necessary. 532 so no manual decoding is necessary.
329 533
330 number 534 number
331 A JSON number becomes either an integer or numeric (floating point) 535 A JSON number becomes either an integer, numeric (floating point) or
332 scalar in perl, depending on its range and any fractional parts. On 536 string scalar in perl, depending on its range and any fractional
333 the Perl level, there is no difference between those as Perl handles 537 parts. On the Perl level, there is no difference between those as
334 all the conversion details, but an integer may take slightly less 538 Perl handles all the conversion details, but an integer may take
335 memory and might represent more values exactly than (floating point) 539 slightly less memory and might represent more values exactly than
336 numbers. 540 (floating point) numbers.
541
542 If the number consists of digits only, JSON::XS will try to
543 represent it as an integer value. If that fails, it will try to
544 represent it as a numeric (floating point) value if that is possible
545 without loss of precision. Otherwise it will preserve the number as
546 a string value.
547
548 Numbers containing a fractional or exponential part will always be
549 represented as numeric (floating point) values, possibly at a loss
550 of precision.
551
552 This might create round-tripping problems as numbers might become
553 strings, but as Perl is typeless there is no other way to do it.
337 554
338 true, false 555 true, false
339 These JSON atoms become 0, 1, respectively. Information is lost in 556 These JSON atoms become "JSON::XS::true" and "JSON::XS::false",
340 this process. Future versions might represent those values 557 respectively. They are overloaded to act almost exactly like the
341 differently, but they will be guarenteed to act like these integers 558 numbers 1 and 0. You can check wether a scalar is a JSON boolean by
342 would normally in Perl. 559 using the "JSON::XS::is_bool" function.
343 560
344 null 561 null
345 A JSON null atom becomes "undef" in Perl. 562 A JSON null atom becomes "undef" in Perl.
346 563
347 PERL -> JSON 564 PERL -> JSON
371 can also use "JSON::XS::false" and "JSON::XS::true" to improve 588 can also use "JSON::XS::false" and "JSON::XS::true" to improve
372 readability. 589 readability.
373 590
374 to_json [\0,JSON::XS::true] # yields [false,true] 591 to_json [\0,JSON::XS::true] # yields [false,true]
375 592
593 JSON::XS::true, JSON::XS::false
594 These special values become JSON true and JSON false values,
595 respectively. You cna alos use "\1" and "\0" directly if you want.
596
376 blessed objects 597 blessed objects
377 Blessed objects are not allowed. JSON::XS currently tries to encode 598 Blessed objects are not allowed. JSON::XS currently tries to encode
378 their underlying representation (hash- or arrayref), but this 599 their underlying representation (hash- or arrayref), but this
379 behaviour might change in future versions. 600 behaviour might change in future versions.
380 601
490 Does not generate valid JSON texts (key strings are often unquoted, 711 Does not generate valid JSON texts (key strings are often unquoted,
491 empty keys result in nothing being output) 712 empty keys result in nothing being output)
492 713
493 Does not check input for validity. 714 Does not check input for validity.
494 715
716 JSON and YAML
717 You often hear that JSON is a subset (or a close subset) of YAML. This
718 is, however, a mass hysteria and very far from the truth. In general,
719 there is no way to configure JSON::XS to output a data structure as
720 valid YAML.
721
722 If you really must use JSON::XS to generate YAML, you should use this
723 algorithm (subject to change in future versions):
724
725 my $to_yaml = JSON::XS->new->utf8->space_after (1);
726 my $yaml = $to_yaml->encode ($ref) . "\n";
727
728 This will usually generate JSON texts that also parse as valid YAML.
729 Please note that YAML has hardcoded limits on (simple) object key
730 lengths that JSON doesn't have, so you should make sure that your hash
731 keys are noticably shorter than the 1024 characters YAML allows.
732
733 There might be other incompatibilities that I am not aware of. In
734 general you should not try to generate YAML with a JSON generator or
735 vice versa, or try to parse JSON with a YAML parser or vice versa:
736 chances are high that you will run into severe interoperability
737 problems.
738
495 SPEED 739 SPEED
496 It seems that JSON::XS is surprisingly fast, as shown in the following 740 It seems that JSON::XS is surprisingly fast, as shown in the following
497 tables. They have been generated with the help of the "eg/bench" program 741 tables. They have been generated with the help of the "eg/bench" program
498 in the JSON::XS distribution, to make it easy to compare on your own 742 in the JSON::XS distribution, to make it easy to compare on your own
499 system. 743 system.
500 744
501 First comes a comparison between various modules using a very short JSON 745 First comes a comparison between various modules using a very short
502 string: 746 single-line JSON string:
503 747
504 {"method": "handleMessage", "params": ["user1", "we were just talking"], "id": null} 748 {"method": "handleMessage", "params": ["user1", "we were just talking"], \
749 "id": null, "array":[1,11,234,-5,1e5,1e7, true, false]}
505 750
506 It shows the number of encodes/decodes per second (JSON::XS uses the 751 It shows the number of encodes/decodes per second (JSON::XS uses the
507 functional interface, while JSON::XS/2 uses the OO interface with 752 functional interface, while JSON::XS/2 uses the OO interface with
508 pretty-printing and hashkey sorting enabled). Higher is better: 753 pretty-printing and hashkey sorting enabled, JSON::XS/3 enables shrink).
754 Higher is better:
509 755
756 Storable | 15779.925 | 14169.946 |
757 -----------+------------+------------+
510 module | encode | decode | 758 module | encode | decode |
511 -----------|------------|------------| 759 -----------|------------|------------|
512 JSON | 11488.516 | 7823.035 | 760 JSON | 4990.842 | 4088.813 |
513 JSON::DWIW | 94708.054 | 129094.260 | 761 JSON::DWIW | 51653.990 | 71575.154 |
514 JSON::PC | 63884.157 | 128528.212 | 762 JSON::PC | 65948.176 | 74631.744 |
763 JSON::PP | 8931.652 | 3817.168 |
515 JSON::Syck | 34898.677 | 42096.911 | 764 JSON::Syck | 24877.248 | 27776.848 |
516 JSON::XS | 654027.064 | 396423.669 | 765 JSON::XS | 388361.481 | 227951.304 |
517 JSON::XS/2 | 371564.190 | 371725.613 | 766 JSON::XS/2 | 227951.304 | 218453.333 |
767 JSON::XS/3 | 338250.323 | 218453.333 |
768 Storable | 16500.016 | 135300.129 |
518 -----------+------------+------------+ 769 -----------+------------+------------+
519 770
520 That is, JSON::XS is more than six times faster than JSON::DWIW on 771 That is, JSON::XS is about five times faster than JSON::DWIW on
521 encoding, more than three times faster on decoding, and about thirty 772 encoding, about three times faster on decoding, and over fourty times
522 times faster than JSON, even with pretty-printing and key sorting. 773 faster than JSON, even with pretty-printing and key sorting. It also
774 compares favourably to Storable for small amounts of data.
523 775
524 Using a longer test string (roughly 18KB, generated from Yahoo! Locals 776 Using a longer test string (roughly 18KB, generated from Yahoo! Locals
525 search API (http://nanoref.com/yahooapis/mgPdGg): 777 search API (http://nanoref.com/yahooapis/mgPdGg):
526 778
527 module | encode | decode | 779 module | encode | decode |
528 -----------|------------|------------| 780 -----------|------------|------------|
529 JSON | 273.023 | 44.674 | 781 JSON | 55.260 | 34.971 |
530 JSON::DWIW | 1089.383 | 1145.704 | 782 JSON::DWIW | 825.228 | 1082.513 |
531 JSON::PC | 3097.419 | 2393.921 | 783 JSON::PC | 3571.444 | 2394.829 |
532 JSON::Syck | 514.060 | 843.053 | 784 JSON::PP | 210.987 | 32.574 |
533 JSON::XS | 6479.668 | 3636.364 | 785 JSON::Syck | 552.551 | 787.544 |
534 JSON::XS/2 | 3774.221 | 3599.124 | 786 JSON::XS | 5780.463 | 4854.519 |
787 JSON::XS/2 | 3869.998 | 4798.975 |
788 JSON::XS/3 | 5862.880 | 4798.975 |
789 Storable | 4445.002 | 5235.027 |
535 -----------+------------+------------+ 790 -----------+------------+------------+
536 791
537 Again, JSON::XS leads by far. 792 Again, JSON::XS leads by far (except for Storable which non-surprisingly
793 decodes faster).
538 794
539 On large strings containing lots of high unicode characters, some 795 On large strings containing lots of high unicode characters, some
540 modules (such as JSON::PC) seem to decode faster than JSON::XS, but the 796 modules (such as JSON::PC) seem to decode faster than JSON::XS, but the
541 result will be broken due to missing (or wrong) unicode handling. Others 797 result will be broken due to missing (or wrong) unicode handling. Others
542 refuse to decode or encode properly, so it was impossible to prepare a 798 refuse to decode or encode properly, so it was impossible to prepare a
553 Second, you need to avoid resource-starving attacks. That means you 809 Second, you need to avoid resource-starving attacks. That means you
554 should limit the size of JSON texts you accept, or make sure then when 810 should limit the size of JSON texts you accept, or make sure then when
555 your resources run out, thats just fine (e.g. by using a separate 811 your resources run out, thats just fine (e.g. by using a separate
556 process that can crash safely). The size of a JSON text in octets or 812 process that can crash safely). The size of a JSON text in octets or
557 characters is usually a good indication of the size of the resources 813 characters is usually a good indication of the size of the resources
558 required to decode it into a Perl structure. 814 required to decode it into a Perl structure. While JSON::XS can check
815 the size of the JSON text, it might be too late when you already have it
816 in memory, so you might want to check the size before you accept the
817 string.
559 818
560 Third, JSON::XS recurses using the C stack when decoding objects and 819 Third, JSON::XS recurses using the C stack when decoding objects and
561 arrays. The C stack is a limited resource: for instance, on my amd64 820 arrays. The C stack is a limited resource: for instance, on my amd64
562 machine with 8MB of stack size I can decode around 180k nested arrays 821 machine with 8MB of stack size I can decode around 180k nested arrays
563 but only 14k nested JSON objects (due to perl itself recursing deeply on 822 but only 14k nested JSON objects (due to perl itself recursing deeply on
565 to be conservative, the default nesting limit is set to 512. If your 824 to be conservative, the default nesting limit is set to 512. If your
566 process has a smaller stack, you should adjust this setting accordingly 825 process has a smaller stack, you should adjust this setting accordingly
567 with the "max_depth" method. 826 with the "max_depth" method.
568 827
569 And last but least, something else could bomb you that I forgot to think 828 And last but least, something else could bomb you that I forgot to think
570 of. In that case, you get to keep the pieces. I am alway sopen for 829 of. In that case, you get to keep the pieces. I am always open for
571 hints, though... 830 hints, though...
831
832 If you are using JSON::XS to return packets to consumption by javascript
833 scripts in a browser you should have a look at
834 <http://jpsykes.com/47/practical-csrf-and-json-security> to see wether
835 you are vulnerable to some common attack vectors (which really are
836 browser design bugs, but it is still you who will have to deal with it,
837 as major browser developers care only for features, not about doing
838 security right).
572 839
573BUGS 840BUGS
574 While the goal of this module is to be correct, that unfortunately does 841 While the goal of this module is to be correct, that unfortunately does
575 not mean its bug-free, only that I think its design is bug-free. It is 842 not mean its bug-free, only that I think its design is bug-free. It is
576 still relatively early in its development. If you keep reporting bugs 843 still relatively early in its development. If you keep reporting bugs

Diff Legend

Removed lines
+ Added lines
< Changed lines
> Changed lines