ViewVC Help
View File | Revision Log | Show Annotations | Download File
/cvs/JSON-XS/README
(Generate patch)

Comparing JSON-XS/README (file contents):
Revision 1.36 by root, Wed Jul 27 15:53:40 2011 UTC vs.
Revision 1.40 by root, Fri Feb 26 21:46:45 2016 UTC

… …
77 too. 77 too.
78 78
79 * simple to use 79 * simple to use
80 80
81 This module has both a simple functional interface as well as an 81 This module has both a simple functional interface as well as an
82 object oriented interface interface. 82 object oriented interface.
83 83
84 * reasonably versatile output formats 84 * reasonably versatile output formats
85 85
86 You can choose between the most compact guaranteed-single-line 86 You can choose between the most compact guaranteed-single-line
87 format possible (nice for simple line-based protocols), a pure-ASCII 87 format possible (nice for simple line-based protocols), a pure-ASCII
… …
112 This function call is functionally identical to: 112 This function call is functionally identical to:
113 113
114 $perl_scalar = JSON::XS->new->utf8->decode ($json_text) 114 $perl_scalar = JSON::XS->new->utf8->decode ($json_text)
115 115
116 Except being faster. 116 Except being faster.
117
118 $is_boolean = JSON::XS::is_bool $scalar
119 Returns true if the passed scalar represents either JSON::XS::true
120 or JSON::XS::false, two constants that act like 1 and 0,
121 respectively and are used to represent JSON "true" and "false"
122 values in Perl.
123
124 See MAPPING, below, for more information on how JSON values are
125 mapped to Perl.
126 117
127A FEW NOTES ON UNICODE AND PERL 118A FEW NOTES ON UNICODE AND PERL
128 Since this often leads to confusion, here are a few very clear words on 119 Since this often leads to confusion, here are a few very clear words on
129 how Unicode works in Perl, modulo bugs. 120 how Unicode works in Perl, modulo bugs.
130 121
… …
361 [ 352 [
362 1, # this comment not allowed in JSON 353 1, # this comment not allowed in JSON
363 # neither this one... 354 # neither this one...
364 ] 355 ]
365 356
357 * literal ASCII TAB characters in strings
358
359 Literal ASCII TAB characters are now allowed in strings (and
360 treated as "\t").
361
362 [
363 "Hello\tWorld",
364 "Hello<TAB>World", # literal <TAB> would not normally be allowed
365 ]
366
366 $json = $json->canonical ([$enable]) 367 $json = $json->canonical ([$enable])
367 $enabled = $json->get_canonical 368 $enabled = $json->get_canonical
368 If $enable is true (or missing), then the "encode" method will 369 If $enable is true (or missing), then the "encode" method will
369 output JSON objects by sorting their keys. This is adding a 370 output JSON objects by sorting their keys. This is adding a
370 comparatively high overhead. 371 comparatively high overhead.
371 372
372 If $enable is false, then the "encode" method will output key-value 373 If $enable is false, then the "encode" method will output key-value
373 pairs in the order Perl stores them (which will likely change 374 pairs in the order Perl stores them (which will likely change
374 between runs of the same script). 375 between runs of the same script, and can change even within the same
376 run from 5.18 onwards).
375 377
376 This option is useful if you want the same data structure to be 378 This option is useful if you want the same data structure to be
377 encoded as the same JSON text (given the same overall settings). If 379 encoded as the same JSON text (given the same overall settings). If
378 it is disabled, the same hash might be encoded differently even if 380 it is disabled, the same hash might be encoded differently even if
379 contains the same data, as key-value pairs have no inherent ordering 381 contains the same data, as key-value pairs have no inherent ordering
… …
416 recommended to leave it off unless you know your communications 418 recommended to leave it off unless you know your communications
417 partner. 419 partner.
418 420
419 $json = $json->allow_blessed ([$enable]) 421 $json = $json->allow_blessed ([$enable])
420 $enabled = $json->get_allow_blessed 422 $enabled = $json->get_allow_blessed
423 See "OBJECT SERIALISATION" for details.
424
421 If $enable is true (or missing), then the "encode" method will not 425 If $enable is true (or missing), then the "encode" method will not
422 barf when it encounters a blessed reference. Instead, the value of 426 barf when it encounters a blessed reference that it cannot convert
423 the convert_blessed option will decide whether "null" 427 otherwise. Instead, a JSON "null" value is encoded instead of the
424 ("convert_blessed" disabled or no "TO_JSON" method found) or a 428 object.
425 representation of the object ("convert_blessed" enabled and
426 "TO_JSON" method found) is being encoded. Has no effect on "decode".
427 429
428 If $enable is false (the default), then "encode" will throw an 430 If $enable is false (the default), then "encode" will throw an
429 exception when it encounters a blessed object. 431 exception when it encounters a blessed object that it cannot convert
432 otherwise.
433
434 This setting has no effect on "decode".
430 435
431 $json = $json->convert_blessed ([$enable]) 436 $json = $json->convert_blessed ([$enable])
432 $enabled = $json->get_convert_blessed 437 $enabled = $json->get_convert_blessed
438 See "OBJECT SERIALISATION" for details.
439
433 If $enable is true (or missing), then "encode", upon encountering a 440 If $enable is true (or missing), then "encode", upon encountering a
434 blessed object, will check for the availability of the "TO_JSON" 441 blessed object, will check for the availability of the "TO_JSON"
435 method on the object's class. If found, it will be called in scalar 442 method on the object's class. If found, it will be called in scalar
436 context and the resulting scalar will be encoded instead of the 443 context and the resulting scalar will be encoded instead of the
437 object. If no "TO_JSON" method is found, the value of 444 object.
438 "allow_blessed" will decide what to do.
439 445
440 The "TO_JSON" method may safely call die if it wants. If "TO_JSON" 446 The "TO_JSON" method may safely call die if it wants. If "TO_JSON"
441 returns other blessed objects, those will be handled in the same 447 returns other blessed objects, those will be handled in the same
442 way. "TO_JSON" must take care of not causing an endless recursion 448 way. "TO_JSON" must take care of not causing an endless recursion
443 cycle (== crash) in this case. The name of "TO_JSON" was chosen 449 cycle (== crash) in this case. The name of "TO_JSON" was chosen
444 because other methods called by the Perl core (== not by the user of 450 because other methods called by the Perl core (== not by the user of
445 the object) are usually in upper case letters and to avoid 451 the object) are usually in upper case letters and to avoid
446 collisions with any "to_json" function or method. 452 collisions with any "to_json" function or method.
447 453
448 This setting does not yet influence "decode" in any way, but in the 454 If $enable is false (the default), then "encode" will not consider
449 future, global hooks might get installed that influence "decode" and 455 this type of conversion.
450 are enabled by this setting.
451 456
452 If $enable is false, then the "allow_blessed" setting will decide 457 This setting has no effect on "decode".
453 what to do when a blessed object is found. 458
459 $json = $json->allow_tags ([$enable])
460 $enabled = $json->allow_tags
461 See "OBJECT SERIALISATION" for details.
462
463 If $enable is true (or missing), then "encode", upon encountering a
464 blessed object, will check for the availability of the "FREEZE"
465 method on the object's class. If found, it will be used to serialise
466 the object into a nonstandard tagged JSON value (that JSON decoders
467 cannot decode).
468
469 It also causes "decode" to parse such tagged JSON values and
470 deserialise them via a call to the "THAW" method.
471
472 If $enable is false (the default), then "encode" will not consider
473 this type of conversion, and tagged JSON values will cause a parse
474 error in "decode", as if tags were not part of the grammar.
454 475
455 $json = $json->filter_json_object ([$coderef->($hashref)]) 476 $json = $json->filter_json_object ([$coderef->($hashref)])
456 When $coderef is specified, it will be called from "decode" each 477 When $coderef is specified, it will be called from "decode" each
457 time it decodes a JSON object. The only argument is a reference to 478 time it decodes a JSON object. The only argument is a reference to
458 the newly-created hash. If the code references returns a single 479 the newly-created hash. If the code references returns a single
… …
594 615
595 See SECURITY CONSIDERATIONS, below, for more info on why this is 616 See SECURITY CONSIDERATIONS, below, for more info on why this is
596 useful. 617 useful.
597 618
598 $json_text = $json->encode ($perl_scalar) 619 $json_text = $json->encode ($perl_scalar)
599 Converts the given Perl data structure (a simple scalar or a 620 Converts the given Perl value or data structure to its JSON
600 reference to a hash or array) to its JSON representation. Simple 621 representation. Croaks on error.
601 scalars will be converted into JSON string or number sequences,
602 while references to arrays become JSON arrays and references to
603 hashes become JSON objects. Undefined Perl values (e.g. "undef")
604 become JSON "null" values. Neither "true" nor "false" values will be
605 generated.
606 622
607 $perl_scalar = $json->decode ($json_text) 623 $perl_scalar = $json->decode ($json_text)
608 The opposite of "encode": expects a JSON text and tries to parse it, 624 The opposite of "encode": expects a JSON text and tries to parse it,
609 returning the resulting simple scalar or reference. Croaks on error. 625 returning the resulting simple scalar or reference. Croaks on error.
610
611 JSON numbers and strings become simple Perl scalars. JSON arrays
612 become Perl arrayrefs and JSON objects become Perl hashrefs. "true"
613 becomes 1, "false" becomes 0 and "null" becomes "undef".
614 626
615 ($perl_scalar, $characters) = $json->decode_prefix ($json_text) 627 ($perl_scalar, $characters) = $json->decode_prefix ($json_text)
616 This works like the "decode" method, but instead of raising an 628 This works like the "decode" method, but instead of raising an
617 exception when there is trailing garbage after the first JSON 629 exception when there is trailing garbage after the first JSON
618 object, it will silently stop parsing there and return the number of 630 object, it will silently stop parsing there and return the number of
619 characters consumed so far. 631 characters consumed so far.
620 632
621 This is useful if your JSON texts are not delimited by an outer 633 This is useful if your JSON texts are not delimited by an outer
622 protocol (which is not the brightest thing to do in the first place)
623 and you need to know where the JSON text ends. 634 protocol and you need to know where the JSON text ends.
624 635
625 JSON::XS->new->decode_prefix ("[1] the tail") 636 JSON::XS->new->decode_prefix ("[1] the tail")
626 => ([], 3) 637 => ([1], 3)
627 638
628INCREMENTAL PARSING 639INCREMENTAL PARSING
629 In some cases, there is the need for incremental parsing of JSON texts. 640 In some cases, there is the need for incremental parsing of JSON texts.
630 While this module always has to keep both JSON text and resulting Perl 641 While this module always has to keep both JSON text and resulting Perl
631 data structure in memory at one time, it does allow you to parse a JSON 642 data structure in memory at one time, it does allow you to parse a JSON
… …
660 671
661 If the method is called in scalar context, then it will try to 672 If the method is called in scalar context, then it will try to
662 extract exactly *one* JSON object. If that is successful, it will 673 extract exactly *one* JSON object. If that is successful, it will
663 return this object, otherwise it will return "undef". If there is a 674 return this object, otherwise it will return "undef". If there is a
664 parse error, this method will croak just as "decode" would do (one 675 parse error, this method will croak just as "decode" would do (one
665 can then use "incr_skip" to skip the errornous part). This is the 676 can then use "incr_skip" to skip the erroneous part). This is the
666 most common way of using the method. 677 most common way of using the method.
667 678
668 And finally, in list context, it will try to extract as many objects 679 And finally, in list context, it will try to extract as many objects
669 from the stream as it can find and return them, or the empty list 680 from the stream as it can find and return them, or the empty list
670 otherwise. For this to work, there must be no separators between the 681 otherwise. For this to work, there must be no separators between the
… …
698 "incr_parse" died, in which case the input buffer and incremental 709 "incr_parse" died, in which case the input buffer and incremental
699 parser state is left unchanged, to skip the text parsed so far and 710 parser state is left unchanged, to skip the text parsed so far and
700 to reset the parse state. 711 to reset the parse state.
701 712
702 The difference to "incr_reset" is that only text until the parse 713 The difference to "incr_reset" is that only text until the parse
703 error occured is removed. 714 error occurred is removed.
704 715
705 $json->incr_reset 716 $json->incr_reset
706 This completely resets the incremental parser, that is, after this 717 This completely resets the incremental parser, that is, after this
707 call, it will be as if the parser had never parsed anything. 718 call, it will be as if the parser had never parsed anything.
708 719
… …
892 If the number consists of digits only, JSON::XS will try to 903 If the number consists of digits only, JSON::XS will try to
893 represent it as an integer value. If that fails, it will try to 904 represent it as an integer value. If that fails, it will try to
894 represent it as a numeric (floating point) value if that is possible 905 represent it as a numeric (floating point) value if that is possible
895 without loss of precision. Otherwise it will preserve the number as 906 without loss of precision. Otherwise it will preserve the number as
896 a string value (in which case you lose roundtripping ability, as the 907 a string value (in which case you lose roundtripping ability, as the
897 JSON number will be re-encoded toa JSON string). 908 JSON number will be re-encoded to a JSON string).
898 909
899 Numbers containing a fractional or exponential part will always be 910 Numbers containing a fractional or exponential part will always be
900 represented as numeric (floating point) values, possibly at a loss 911 represented as numeric (floating point) values, possibly at a loss
901 of precision (in which case you might lose perfect roundtripping 912 of precision (in which case you might lose perfect roundtripping
902 ability, but the JSON number will still be re-encoded as a JSON 913 ability, but the JSON number will still be re-encoded as a JSON
903 number). 914 number).
904 915
905 Note that precision is not accuracy - binary floating point values 916 Note that precision is not accuracy - binary floating point values
906 cannot represent most decimal fractions exactly, and when converting 917 cannot represent most decimal fractions exactly, and when converting
907 from and to floating point, JSON::XS only guarantees precision up to 918 from and to floating point, JSON::XS only guarantees precision up to
908 but not including the leats significant bit. 919 but not including the least significant bit.
909 920
910 true, false 921 true, false
911 These JSON atoms become "JSON::XS::true" and "JSON::XS::false", 922 These JSON atoms become "Types::Serialiser::true" and
912 respectively. They are overloaded to act almost exactly like the 923 "Types::Serialiser::false", respectively. They are overloaded to act
913 numbers 1 and 0. You can check whether a scalar is a JSON boolean by 924 almost exactly like the numbers 1 and 0. You can check whether a
914 using the "JSON::XS::is_bool" function. 925 scalar is a JSON boolean by using the "Types::Serialiser::is_bool"
926 function (after "use Types::Serialier", of course).
915 927
916 null 928 null
917 A JSON null atom becomes "undef" in Perl. 929 A JSON null atom becomes "undef" in Perl.
930
931 shell-style comments ("# *text*")
932 As a nonstandard extension to the JSON syntax that is enabled by the
933 "relaxed" setting, shell-style comments are allowed. They can start
934 anywhere outside strings and go till the end of the line.
935
936 tagged values ("(*tag*)*value*").
937 Another nonstandard extension to the JSON syntax, enabled with the
938 "allow_tags" setting, are tagged values. In this implementation, the
939 *tag* must be a perl package/class name encoded as a JSON string,
940 and the *value* must be a JSON array encoding optional constructor
941 arguments.
942
943 See "OBJECT SERIALISATION", below, for details.
918 944
919 PERL -> JSON 945 PERL -> JSON
920 The mapping from Perl to JSON is slightly more difficult, as Perl is a 946 The mapping from Perl to JSON is slightly more difficult, as Perl is a
921 truly typeless language, so we can only guess which JSON type is meant 947 truly typeless language, so we can only guess which JSON type is meant
922 by a Perl value. 948 by a Perl value.
923 949
924 hash references 950 hash references
925 Perl hash references become JSON objects. As there is no inherent 951 Perl hash references become JSON objects. As there is no inherent
926 ordering in hash keys (or JSON objects), they will usually be 952 ordering in hash keys (or JSON objects), they will usually be
927 encoded in a pseudo-random order that can change between runs of the 953 encoded in a pseudo-random order. JSON::XS can optionally sort the
928 same program but stays generally the same within a single run of a 954 hash keys (determined by the *canonical* flag), so the same
929 program. JSON::XS can optionally sort the hash keys (determined by 955 datastructure will serialise to the same JSON text (given same
930 the *canonical* flag), so the same datastructure will serialise to 956 settings and version of JSON::XS), but this incurs a runtime
931 the same JSON text (given same settings and version of JSON::XS), 957 overhead and is only rarely useful, e.g. when you want to compare
932 but this incurs a runtime overhead and is only rarely useful, e.g. 958 some JSON text against another for equality.
933 when you want to compare some JSON text against another for
934 equality.
935 959
936 array references 960 array references
937 Perl array references become JSON arrays. 961 Perl array references become JSON arrays.
938 962
939 other references 963 other references
940 Other unblessed references are generally not allowed and will cause 964 Other unblessed references are generally not allowed and will cause
941 an exception to be thrown, except for references to the integers 0 965 an exception to be thrown, except for references to the integers 0
942 and 1, which get turned into "false" and "true" atoms in JSON. You 966 and 1, which get turned into "false" and "true" atoms in JSON.
943 can also use "JSON::XS::false" and "JSON::XS::true" to improve 967
968 Since "JSON::XS" uses the boolean model from Types::Serialiser, you
969 can also "use Types::Serialiser" and then use
970 "Types::Serialiser::false" and "Types::Serialiser::true" to improve
944 readability. 971 readability.
945 972
973 use Types::Serialiser;
946 encode_json [\0, JSON::XS::true] # yields [false,true] 974 encode_json [\0, Types::Serialiser::true] # yields [false,true]
947 975
948 JSON::XS::true, JSON::XS::false 976 Types::Serialiser::true, Types::Serialiser::false
949 These special values become JSON true and JSON false values, 977 These special values from the Types::Serialiser module become JSON
950 respectively. You can also use "\1" and "\0" directly if you want. 978 true and JSON false values, respectively. You can also use "\1" and
979 "\0" directly if you want.
951 980
952 blessed objects 981 blessed objects
953 Blessed objects are not directly representable in JSON. See the 982 Blessed objects are not directly representable in JSON, but
954 "allow_blessed" and "convert_blessed" methods on various options on 983 "JSON::XS" allows various ways of handling objects. See "OBJECT
955 how to deal with this: basically, you can choose between throwing an 984 SERIALISATION", below, for details.
956 exception, encoding the reference as if it weren't blessed, or
957 provide your own serialiser method.
958 985
959 simple scalars 986 simple scalars
960 Simple Perl scalars (any scalar that is not a reference) are the 987 Simple Perl scalars (any scalar that is not a reference) are the
961 most difficult objects to encode: JSON::XS will encode undefined 988 most difficult objects to encode: JSON::XS will encode undefined
962 scalars as JSON "null" values, scalars that have last been used in a 989 scalars as JSON "null" values, scalars that have last been used in a
… …
997 which can differ to other languages). Also, your perl interpreter 1024 which can differ to other languages). Also, your perl interpreter
998 might expose extensions to the floating point numbers of your 1025 might expose extensions to the floating point numbers of your
999 platform, such as infinities or NaN's - these cannot be represented 1026 platform, such as infinities or NaN's - these cannot be represented
1000 in JSON, and it is an error to pass those in. 1027 in JSON, and it is an error to pass those in.
1001 1028
1029 OBJECT SERIALISATION
1030 As JSON cannot directly represent Perl objects, you have to choose
1031 between a pure JSON representation (without the ability to deserialise
1032 the object automatically again), and a nonstandard extension to the JSON
1033 syntax, tagged values.
1034
1035 SERIALISATION
1036 What happens when "JSON::XS" encounters a Perl object depends on the
1037 "allow_blessed", "convert_blessed" and "allow_tags" settings, which are
1038 used in this order:
1039
1040 1. "allow_tags" is enabled and the object has a "FREEZE" method.
1041 In this case, "JSON::XS" uses the Types::Serialiser object
1042 serialisation protocol to create a tagged JSON value, using a
1043 nonstandard extension to the JSON syntax.
1044
1045 This works by invoking the "FREEZE" method on the object, with the
1046 first argument being the object to serialise, and the second
1047 argument being the constant string "JSON" to distinguish it from
1048 other serialisers.
1049
1050 The "FREEZE" method can return any number of values (i.e. zero or
1051 more). These values and the paclkage/classname of the object will
1052 then be encoded as a tagged JSON value in the following format:
1053
1054 ("classname")[FREEZE return values...]
1055
1056 e.g.:
1057
1058 ("URI")["http://www.google.com/"]
1059 ("MyDate")[2013,10,29]
1060 ("ImageData::JPEG")["Z3...VlCg=="]
1061
1062 For example, the hypothetical "My::Object" "FREEZE" method might use
1063 the objects "type" and "id" members to encode the object:
1064
1065 sub My::Object::FREEZE {
1066 my ($self, $serialiser) = @_;
1067
1068 ($self->{type}, $self->{id})
1069 }
1070
1071 2. "convert_blessed" is enabled and the object has a "TO_JSON" method.
1072 In this case, the "TO_JSON" method of the object is invoked in
1073 scalar context. It must return a single scalar that can be directly
1074 encoded into JSON. This scalar replaces the object in the JSON text.
1075
1076 For example, the following "TO_JSON" method will convert all URI
1077 objects to JSON strings when serialised. The fatc that these values
1078 originally were URI objects is lost.
1079
1080 sub URI::TO_JSON {
1081 my ($uri) = @_;
1082 $uri->as_string
1083 }
1084
1085 3. "allow_blessed" is enabled.
1086 The object will be serialised as a JSON null value.
1087
1088 4. none of the above
1089 If none of the settings are enabled or the respective methods are
1090 missing, "JSON::XS" throws an exception.
1091
1092 DESERIALISATION
1093 For deserialisation there are only two cases to consider: either
1094 nonstandard tagging was used, in which case "allow_tags" decides, or
1095 objects cannot be automatically be deserialised, in which case you can
1096 use postprocessing or the "filter_json_object" or
1097 "filter_json_single_key_object" callbacks to get some real objects our
1098 of your JSON.
1099
1100 This section only considers the tagged value case: I a tagged JSON
1101 object is encountered during decoding and "allow_tags" is disabled, a
1102 parse error will result (as if tagged values were not part of the
1103 grammar).
1104
1105 If "allow_tags" is enabled, "JSON::XS" will look up the "THAW" method of
1106 the package/classname used during serialisation (it will not attempt to
1107 load the package as a Perl module). If there is no such method, the
1108 decoding will fail with an error.
1109
1110 Otherwise, the "THAW" method is invoked with the classname as first
1111 argument, the constant string "JSON" as second argument, and all the
1112 values from the JSON array (the values originally returned by the
1113 "FREEZE" method) as remaining arguments.
1114
1115 The method must then return the object. While technically you can return
1116 any Perl scalar, you might have to enable the "enable_nonref" setting to
1117 make that work in all cases, so better return an actual blessed
1118 reference.
1119
1120 As an example, let's implement a "THAW" function that regenerates the
1121 "My::Object" from the "FREEZE" example earlier:
1122
1123 sub My::Object::THAW {
1124 my ($class, $serialiser, $type, $id) = @_;
1125
1126 $class->new (type => $type, id => $id)
1127 }
1128
1002ENCODING/CODESET FLAG NOTES 1129ENCODING/CODESET FLAG NOTES
1003 The interested reader might have seen a number of flags that signify 1130 The interested reader might have seen a number of flags that signify
1004 encodings or codesets - "utf8", "latin1" and "ascii". There seems to be 1131 encodings or codesets - "utf8", "latin1" and "ascii". There seems to be
1005 some confusion on what these do, so here is a short comparison: 1132 some confusion on what these do, so here is a short comparison:
1006 1133
… …
1025 1152
1026 "utf8" flag disabled 1153 "utf8" flag disabled
1027 When "utf8" is disabled (the default), then "encode"/"decode" 1154 When "utf8" is disabled (the default), then "encode"/"decode"
1028 generate and expect Unicode strings, that is, characters with high 1155 generate and expect Unicode strings, that is, characters with high
1029 ordinal Unicode values (> 255) will be encoded as such characters, 1156 ordinal Unicode values (> 255) will be encoded as such characters,
1030 and likewise such characters are decoded as-is, no canges to them 1157 and likewise such characters are decoded as-is, no changes to them
1031 will be done, except "(re-)interpreting" them as Unicode codepoints 1158 will be done, except "(re-)interpreting" them as Unicode codepoints
1032 or Unicode characters, respectively (to Perl, these are the same 1159 or Unicode characters, respectively (to Perl, these are the same
1033 thing in strings unless you do funny/weird/dumb stuff). 1160 thing in strings unless you do funny/weird/dumb stuff).
1034 1161
1035 This is useful when you want to do the encoding yourself (e.g. when 1162 This is useful when you want to do the encoding yourself (e.g. when
… …
1151 output for these property strings, e.g.: 1278 output for these property strings, e.g.:
1152 1279
1153 $json =~ s/"__proto__"\s*:/"__proto__renamed":/g; 1280 $json =~ s/"__proto__"\s*:/"__proto__renamed":/g;
1154 1281
1155 This works because "__proto__" is not valid outside of strings, so every 1282 This works because "__proto__" is not valid outside of strings, so every
1156 occurence of ""__proto__"\s*:" must be a string used as property name. 1283 occurrence of ""__proto__"\s*:" must be a string used as property name.
1157 1284
1158 If you know of other incompatibilities, please let me know. 1285 If you know of other incompatibilities, please let me know.
1159 1286
1160 JSON and YAML 1287 JSON and YAML
1161 You often hear that JSON is a subset of YAML. This is, however, a mass 1288 You often hear that JSON is a subset of YAML. This is, however, a mass
… …
1312 to see whether you are vulnerable to some common attack vectors (which 1439 to see whether you are vulnerable to some common attack vectors (which
1313 really are browser design bugs, but it is still you who will have to 1440 really are browser design bugs, but it is still you who will have to
1314 deal with it, as major browser developers care only for features, not 1441 deal with it, as major browser developers care only for features, not
1315 about getting security right). 1442 about getting security right).
1316 1443
1444"OLD" VS. "NEW" JSON (RFC 4627 VS. RFC 7159)
1445 TL;DR: Due to security concerns, JSON::XS will not allow scalar data in
1446 JSON texts by default - you need to create your own JSON::XS object and
1447 enable "allow_nonref":
1448
1449 my $json = JSON::XS->new->allow_nonref;
1450
1451 $text = $json->encode ($data);
1452 $data = $json->decode ($text);
1453
1454 The long version: JSON being an important and supposedly stable format,
1455 the IETF standardised it as RFC 4627 in 2006. Unfortunately, the
1456 inventor of JSON, Dougles Crockford, unilaterally changed the definition
1457 of JSON in javascript. Rather than create a fork, the IETF decided to
1458 standardise the new syntax (apparently, so Iw as told, without finding
1459 it very amusing).
1460
1461 The biggest difference between thed original JSON and the new JSON is
1462 that the new JSON supports scalars (anything other than arrays and
1463 objects) at the toplevel of a JSON text. While this is strictly
1464 backwards compatible to older versions, it breaks a number of protocols
1465 that relied on sending JSON back-to-back, and is a minor security
1466 concern.
1467
1468 For example, imagine you have two banks communicating, and on one side,
1469 trhe JSON coder gets upgraded. Two messages, such as 10 and 1000 might
1470 then be confused to mean 101000, something that couldn't happen in the
1471 original JSON, because niether of these messages would be valid JSON.
1472
1473 If one side accepts these messages, then an upgrade in the coder on
1474 either side could result in this becoming exploitable.
1475
1476 This module has always allowed these messages as an optional extension,
1477 by default disabled. The security concerns are the reason why the
1478 default is still disabled, but future versions might/will likely upgrade
1479 to the newer RFC as default format, so you are advised to check your
1480 implementation and/or override the default with "->allow_nonref (0)" to
1481 ensure that future versions are safe.
1482
1483INTEROPERABILITY WITH OTHER MODULES
1484 "JSON::XS" uses the Types::Serialiser module to provide boolean
1485 constants. That means that the JSON true and false values will be
1486 comaptible to true and false values of iother modules that do the same,
1487 such as JSON::PP and CBOR::XS.
1488
1489INTEROPERABILITY WITH OTHER JSON DECODERS
1490 As long as you only serialise data that can be directly expressed in
1491 JSON, "JSON::XS" is incapable of generating invalid JSON output (modulo
1492 bugs, but "JSON::XS" has found more bugs in the official JSON testsuite
1493 (1) than the official JSON testsuite has found in "JSON::XS" (0)).
1494
1495 When you have trouble decoding JSON generated by this module using other
1496 decoders, then it is very likely that you have an encoding mismatch or
1497 the other decoder is broken.
1498
1499 When decoding, "JSON::XS" is strict by default and will likely catch all
1500 errors. There are currently two settings that change this: "relaxed"
1501 makes "JSON::XS" accept (but not generate) some non-standard extensions,
1502 and "allow_tags" will allow you to encode and decode Perl objects, at
1503 the cost of not outputting valid JSON anymore.
1504
1505 TAGGED VALUE SYNTAX AND STANDARD JSON EN/DECODERS
1506 When you use "allow_tags" to use the extended (and also nonstandard and
1507 invalid) JSON syntax for serialised objects, and you still want to
1508 decode the generated When you want to serialise objects, you can run a
1509 regex to replace the tagged syntax by standard JSON arrays (it only
1510 works for "normal" packagesnames without comma, newlines or single
1511 colons). First, the readable Perl version:
1512
1513 # if your FREEZE methods return no values, you need this replace first:
1514 $json =~ s/\( \s* (" (?: [^\\":,]+|\\.|::)* ") \s* \) \s* \[\s*\]/[$1]/gx;
1515
1516 # this works for non-empty constructor arg lists:
1517 $json =~ s/\( \s* (" (?: [^\\":,]+|\\.|::)* ") \s* \) \s* \[/[$1,/gx;
1518
1519 And here is a less readable version that is easy to adapt to other
1520 languages:
1521
1522 $json =~ s/\(\s*("([^\\":,]+|\\.|::)*")\s*\)\s*\[/[$1,/g;
1523
1524 Here is an ECMAScript version (same regex):
1525
1526 json = json.replace (/\(\s*("([^\\":,]+|\\.|::)*")\s*\)\s*\[/g, "[$1,");
1527
1528 Since this syntax converts to standard JSON arrays, it might be hard to
1529 distinguish serialised objects from normal arrays. You can prepend a
1530 "magic number" as first array element to reduce chances of a collision:
1531
1532 $json =~ s/\(\s*("([^\\":,]+|\\.|::)*")\s*\)\s*\[/["XU1peReLzT4ggEllLanBYq4G9VzliwKF",$1,/g;
1533
1534 And after decoding the JSON text, you could walk the data structure
1535 looking for arrays with a first element of
1536 "XU1peReLzT4ggEllLanBYq4G9VzliwKF".
1537
1538 The same approach can be used to create the tagged format with another
1539 encoder. First, you create an array with the magic string as first
1540 member, the classname as second, and constructor arguments last, encode
1541 it as part of your JSON structure, and then:
1542
1543 $json =~ s/\[\s*"XU1peReLzT4ggEllLanBYq4G9VzliwKF"\s*,\s*("([^\\":,]+|\\.|::)*")\s*,/($1)[/g;
1544
1545 Again, this has some limitations - the magic string must not be encoded
1546 with character escapes, and the constructor arguments must be non-empty.
1547
1548RFC7159
1549 Since this module was written, Google has written a new JSON RFC, RFC
1550 7159 (and RFC7158). Unfortunately, this RFC breaks compatibility with
1551 both the original JSON specification on www.json.org and RFC4627.
1552
1553 As far as I can see, you can get partial compatibility when parsing by
1554 using "->allow_nonref". However, consider thew security implications of
1555 doing so.
1556
1557 I haven't decided yet when to break compatibility with RFC4627 by
1558 default (and potentially leave applications insecure) and change the
1559 default to follow RFC7159, but application authors are well advised to
1560 call "->allow_nonref(0)" even if this is the current default, if they
1561 cannot handle non-reference values, in preparation for the day when the4
1562 default will change.
1563
1317THREADS 1564THREADS
1318 This module is *not* guaranteed to be thread safe and there are no plans 1565 This module is *not* guaranteed to be thread safe and there are no plans
1319 to change this until Perl gets thread support (as opposed to the 1566 to change this until Perl gets thread support (as opposed to the
1320 horribly slow so-called "threads" which are simply slow and bloated 1567 horribly slow so-called "threads" which are simply slow and bloated
1321 process simulations - use fork, it's *much* faster, cheaper, better). 1568 process simulations - use fork, it's *much* faster, cheaper, better).
1322 1569
1323 (It might actually work, but you have been warned). 1570 (It might actually work, but you have been warned).
1324 1571
1572THE PERILS OF SETLOCALE
1573 Sometimes people avoid the Perl locale support and directly call the
1574 system's setlocale function with "LC_ALL".
1575
1576 This breaks both perl and modules such as JSON::XS, as stringification
1577 of numbers no longer works correctly (e.g. "$x = 0.1; print "$x"+1"
1578 might print 1, and JSON::XS might output illegal JSON as JSON::XS relies
1579 on perl to stringify numbers).
1580
1581 The solution is simple: don't call "setlocale", or use it for only those
1582 categories you need, such as "LC_MESSAGES" or "LC_CTYPE".
1583
1584 If you need "LC_NUMERIC", you should enable it only around the code that
1585 actually needs it (avoiding stringification of numbers), and restore it
1586 afterwards.
1587
1325BUGS 1588BUGS
1326 While the goal of this module is to be correct, that unfortunately does 1589 While the goal of this module is to be correct, that unfortunately does
1327 not mean it's bug-free, only that I think its design is bug-free. If you 1590 not mean it's bug-free, only that I think its design is bug-free. If you
1328 keep reporting bugs they will be fixed swiftly, though. 1591 keep reporting bugs they will be fixed swiftly, though.
1329 1592

Diff Legend

– Removed lines
+ Added lines
< Changed lines
> Changed lines