ViewVC Help
View File | Revision Log | Show Annotations | Download File
/cvs/JSON-XS/README
(Generate patch)

Comparing JSON-XS/README (file contents):
Revision 1.9 by root, Thu Mar 29 02:45:49 2007 UTC vs.
Revision 1.16 by root, Thu Jul 26 11:33:35 2007 UTC

7 # exported functions, they croak on error 7 # exported functions, they croak on error
8 # and expect/generate UTF-8 8 # and expect/generate UTF-8
9 9
10 $utf8_encoded_json_text = to_json $perl_hash_or_arrayref; 10 $utf8_encoded_json_text = to_json $perl_hash_or_arrayref;
11 $perl_hash_or_arrayref = from_json $utf8_encoded_json_text; 11 $perl_hash_or_arrayref = from_json $utf8_encoded_json_text;
12
13 # objToJson and jsonToObj aliases to to_json and from_json
14 # are exported for compatibility to the JSON module,
15 # but should not be used in new code.
16 12
17 # OO-interface 13 # OO-interface
18 14
19 $coder = JSON::XS->new->ascii->pretty->allow_nonref; 15 $coder = JSON::XS->new->ascii->pretty->allow_nonref;
20 $pretty_printed_unencoded = $coder->encode ($perl_scalar); 16 $pretty_printed_unencoded = $coder->encode ($perl_scalar);
92 88
93 $perl_scalar = JSON::XS->new->utf8->decode ($json_text) 89 $perl_scalar = JSON::XS->new->utf8->decode ($json_text)
94 90
95 except being faster. 91 except being faster.
96 92
93 $is_boolean = JSON::XS::is_bool $scalar
94 Returns true if the passed scalar represents either JSON::XS::true
95 or JSON::XS::false, two constants that act like 1 and 0,
96 respectively and are used to represent JSON "true" and "false"
97 values in Perl.
98
99 See MAPPING, below, for more information on how JSON values are
100 mapped to Perl.
101
97OBJECT-ORIENTED INTERFACE 102OBJECT-ORIENTED INTERFACE
98 The object oriented interface lets you configure your own encoding or 103 The object oriented interface lets you configure your own encoding or
99 decoding style, within the limits of supported formats. 104 decoding style, within the limits of supported formats.
100 105
101 $json = new JSON::XS 106 $json = new JSON::XS
112 $json = $json->ascii ([$enable]) 117 $json = $json->ascii ([$enable])
113 If $enable is true (or missing), then the "encode" method will not 118 If $enable is true (or missing), then the "encode" method will not
114 generate characters outside the code range 0..127 (which is ASCII). 119 generate characters outside the code range 0..127 (which is ASCII).
115 Any unicode characters outside that range will be escaped using 120 Any unicode characters outside that range will be escaped using
116 either a single \uXXXX (BMP characters) or a double \uHHHH\uLLLLL 121 either a single \uXXXX (BMP characters) or a double \uHHHH\uLLLLL
117 escape sequence, as per RFC4627. 122 escape sequence, as per RFC4627. The resulting encoded JSON text can
123 be treated as a native unicode string, an ascii-encoded,
124 latin1-encoded or UTF-8 encoded string, or any other superset of
125 ASCII.
118 126
119 If $enable is false, then the "encode" method will not escape 127 If $enable is false, then the "encode" method will not escape
120 Unicode characters unless required by the JSON syntax. This results 128 Unicode characters unless required by the JSON syntax or other
121 in a faster and more compact format. 129 flags. This results in a faster and more compact format.
130
131 The main use for this flag is to produce JSON texts that can be
132 transmitted over a 7-bit channel, as the encoded JSON texts will not
133 contain any 8 bit characters.
122 134
123 JSON::XS->new->ascii (1)->encode ([chr 0x10401]) 135 JSON::XS->new->ascii (1)->encode ([chr 0x10401])
124 => ["\ud801\udc01"] 136 => ["\ud801\udc01"]
137
138 $json = $json->latin1 ([$enable])
139 If $enable is true (or missing), then the "encode" method will
140 encode the resulting JSON text as latin1 (or iso-8859-1), escaping
141 any characters outside the code range 0..255. The resulting string
142 can be treated as a latin1-encoded JSON text or a native unicode
143 string. The "decode" method will not be affected in any way by this
144 flag, as "decode" by default expects unicode, which is a strict
145 superset of latin1.
146
147 If $enable is false, then the "encode" method will not escape
148 Unicode characters unless required by the JSON syntax or other
149 flags.
150
151 The main use for this flag is efficiently encoding binary data as
152 JSON text, as most octets will not be escaped, resulting in a
153 smaller encoded size. The disadvantage is that the resulting JSON
154 text is encoded in latin1 (and must correctly be treated as such
155 when storing and transfering), a rare encoding for JSON. It is
156 therefore most useful when you want to store data structures known
157 to contain binary data efficiently in files or databases, not when
158 talking to other JSON encoders/decoders.
159
160 JSON::XS->new->latin1->encode (["\x{89}\x{abc}"]
161 => ["\x{89}\\u0abc"] # (perl syntax, U+abc escaped, U+89 not)
125 162
126 $json = $json->utf8 ([$enable]) 163 $json = $json->utf8 ([$enable])
127 If $enable is true (or missing), then the "encode" method will 164 If $enable is true (or missing), then the "encode" method will
128 encode the JSON result into UTF-8, as required by many protocols, 165 encode the JSON result into UTF-8, as required by many protocols,
129 while the "decode" method expects to be handled an UTF-8-encoded 166 while the "decode" method expects to be handled an UTF-8-encoded
236 Example, encode a Perl scalar as JSON value with enabled 273 Example, encode a Perl scalar as JSON value with enabled
237 "allow_nonref", resulting in an invalid JSON text: 274 "allow_nonref", resulting in an invalid JSON text:
238 275
239 JSON::XS->new->allow_nonref->encode ("Hello, World!") 276 JSON::XS->new->allow_nonref->encode ("Hello, World!")
240 => "Hello, World!" 277 => "Hello, World!"
278
279 $json = $json->allow_blessed ([$enable])
280 If $enable is true (or missing), then the "encode" method will not
281 barf when it encounters a blessed reference. Instead, the value of
282 the convert_blessed option will decide wether "null"
283 ("convert_blessed" disabled or no "to_json" method found) or a
284 representation of the object ("convert_blessed" enabled and
285 "to_json" method found) is being encoded. Has no effect on "decode".
286
287 If $enable is false (the default), then "encode" will throw an
288 exception when it encounters a blessed object.
289
290 $json = $json->convert_blessed ([$enable])
291 If $enable is true (or missing), then "encode", upon encountering a
292 blessed object, will check for the availability of the "TO_JSON"
293 method on the object's class. If found, it will be called in scalar
294 context and the resulting scalar will be encoded instead of the
295 object. If no "TO_JSON" method is found, the value of
296 "allow_blessed" will decide what to do.
297
298 The "TO_JSON" method may safely call die if it wants. If "TO_JSON"
299 returns other blessed objects, those will be handled in the same
300 way. "TO_JSON" must take care of not causing an endless recursion
301 cycle (== crash) in this case. The name of "TO_JSON" was chosen
302 because other methods called by the Perl core (== not by the user of
303 the object) are usually in upper case letters and to avoid
304 collisions with the "to_json" function.
305
306 This setting does not yet influence "decode" in any way, but in the
307 future, global hooks might get installed that influence "decode" and
308 are enabled by this setting.
309
310 If $enable is false, then the "allow_blessed" setting will decide
311 what to do when a blessed object is found.
312
313 $json = $json->filter_json_object ([$coderef->($hashref)])
314 When $coderef is specified, it will be called from "decode" each
315 time it decodes a JSON object. The only argument is a reference to
316 the newly-created hash. If the code references returns a single
317 scalar (which need not be a reference), this value (i.e. a copy of
318 that scalar to avoid aliasing) is inserted into the deserialised
319 data structure. If it returns an empty list (NOTE: *not* "undef",
320 which is a valid scalar), the original deserialised hash will be
321 inserted. This setting can slow down decoding considerably.
322
323 When $coderef is omitted or undefined, any existing callback will be
324 removed and "decode" will not change the deserialised hash in any
325 way.
326
327 Example, convert all JSON objects into the integer 5:
328
329 my $js = JSON::XS->new->filter_json_object (sub { 5 });
330 # returns [5]
331 $js->decode ('[{}]')
332 # throw an exception because allow_nonref is not enabled
333 # so a lone 5 is not allowed.
334 $js->decode ('{"a":1, "b":2}');
335
336 $json = $json->filter_json_single_key_object ($key [=>
337 $coderef->($value)])
338 Works remotely similar to "filter_json_object", but is only called
339 for JSON objects having a single key named $key.
340
341 This $coderef is called before the one specified via
342 "filter_json_object", if any. It gets passed the single value in the
343 JSON object. If it returns a single value, it will be inserted into
344 the data structure. If it returns nothing (not even "undef" but the
345 empty list), the callback from "filter_json_object" will be called
346 next, as if no single-key callback were specified.
347
348 If $coderef is omitted or undefined, the corresponding callback will
349 be disabled. There can only ever be one callback for a given key.
350
351 As this callback gets called less often then the
352 "filter_json_object" one, decoding speed will not usually suffer as
353 much. Therefore, single-key objects make excellent targets to
354 serialise Perl objects into, especially as single-key JSON objects
355 are as close to the type-tagged value concept as JSON gets (its
356 basically an ID/VALUE tuple). Of course, JSON does not support this
357 in any way, so you need to make sure your data never looks like a
358 serialised Perl hash.
359
360 Typical names for the single object key are "__class_whatever__", or
361 "$__dollars_are_rarely_used__$" or "}ugly_brace_placement", or even
362 things like "__class_md5sum(classname)__", to reduce the risk of
363 clashing with real hashes.
364
365 Example, decode JSON objects of the form "{ "__widget__" => <id> }"
366 into the corresponding $WIDGET{<id>} object:
367
368 # return whatever is in $WIDGET{5}:
369 JSON::XS
370 ->new
371 ->filter_json_single_key_object (__widget__ => sub {
372 $WIDGET{ $_[0] }
373 })
374 ->decode ('{"__widget__": 5')
375
376 # this can be used with a TO_JSON method in some "widget" class
377 # for serialisation to json:
378 sub WidgetBase::TO_JSON {
379 my ($self) = @_;
380
381 unless ($self->{id}) {
382 $self->{id} = ..get..some..id..;
383 $WIDGET{$self->{id}} = $self;
384 }
385
386 { __widget__ => $self->{id} }
387 }
241 388
242 $json = $json->shrink ([$enable]) 389 $json = $json->shrink ([$enable])
243 Perl usually over-allocates memory a bit when allocating space for 390 Perl usually over-allocates memory a bit when allocating space for
244 strings. This flag optionally resizes strings generated by either 391 strings. This flag optionally resizes strings generated by either
245 "encode" or "decode" to their minimum size possible. This can save 392 "encode" or "decode" to their minimum size possible. This can save
265 converting strings that look like integers or floats into integers 412 converting strings that look like integers or floats into integers
266 or floats internally (there is no difference on the Perl level), 413 or floats internally (there is no difference on the Perl level),
267 saving space. 414 saving space.
268 415
269 $json = $json->max_depth ([$maximum_nesting_depth]) 416 $json = $json->max_depth ([$maximum_nesting_depth])
270 Sets the maximum nesting level (default 4096) accepted while 417 Sets the maximum nesting level (default 512) accepted while encoding
271 encoding or decoding. If the JSON text or Perl data structure has an 418 or decoding. If the JSON text or Perl data structure has an equal or
272 equal or higher nesting level then this limit, then the encoder and 419 higher nesting level then this limit, then the encoder and decoder
273 decoder will stop and croak at that point. 420 will stop and croak at that point.
274 421
275 Nesting level is defined by number of hash- or arrayrefs that the 422 Nesting level is defined by number of hash- or arrayrefs that the
276 encoder needs to traverse to reach a given point or the number of 423 encoder needs to traverse to reach a given point or the number of
277 "{" or "[" characters without their matching closing parenthesis 424 "{" or "[" characters without their matching closing parenthesis
278 crossed to reach a given character in a string. 425 crossed to reach a given character in a string.
279 426
280 Setting the maximum depth to one disallows any nesting, so that 427 Setting the maximum depth to one disallows any nesting, so that
281 ensures that the object is only a single hash/object or array. 428 ensures that the object is only a single hash/object or array.
282 429
283 The argument to "max_depth" will be rounded up to the next nearest 430 The argument to "max_depth" will be rounded up to the next highest
284 power of two. 431 power of two. If no argument is given, the highest possible setting
432 will be used, which is rarely useful.
433
434 See SECURITY CONSIDERATIONS, below, for more info on why this is
435 useful.
436
437 $json = $json->max_size ([$maximum_string_size])
438 Set the maximum length a JSON text may have (in bytes) where
439 decoding is being attempted. The default is 0, meaning no limit.
440 When "decode" is called on a string longer then this number of
441 characters it will not attempt to decode the string but throw an
442 exception. This setting has no effect on "encode" (yet).
443
444 The argument to "max_size" will be rounded up to the next highest
445 power of two (so may be more than requested). If no argument is
446 given, the limit check will be deactivated (same as when 0 is
447 specified).
285 448
286 See SECURITY CONSIDERATIONS, below, for more info on why this is 449 See SECURITY CONSIDERATIONS, below, for more info on why this is
287 useful. 450 useful.
288 451
289 $json_text = $json->encode ($perl_scalar) 452 $json_text = $json->encode ($perl_scalar)
301 464
302 JSON numbers and strings become simple Perl scalars. JSON arrays 465 JSON numbers and strings become simple Perl scalars. JSON arrays
303 become Perl arrayrefs and JSON objects become Perl hashrefs. "true" 466 become Perl arrayrefs and JSON objects become Perl hashrefs. "true"
304 becomes 1, "false" becomes 0 and "null" becomes "undef". 467 becomes 1, "false" becomes 0 and "null" becomes "undef".
305 468
469 ($perl_scalar, $characters) = $json->decode_prefix ($json_text)
470 This works like the "decode" method, but instead of raising an
471 exception when there is trailing garbage after the first JSON
472 object, it will silently stop parsing there and return the number of
473 characters consumed so far.
474
475 This is useful if your JSON texts are not delimited by an outer
476 protocol (which is not the brightest thing to do in the first place)
477 and you need to know where the JSON text ends.
478
479 JSON::XS->new->decode_prefix ("[1] the tail")
480 => ([], 3)
481
306MAPPING 482MAPPING
307 This section describes how JSON::XS maps Perl values to JSON values and 483 This section describes how JSON::XS maps Perl values to JSON values and
308 vice versa. These mappings are designed to "do the right thing" in most 484 vice versa. These mappings are designed to "do the right thing" in most
309 circumstances automatically, preserving round-tripping characteristics 485 circumstances automatically, preserving round-tripping characteristics
310 (what you put in comes out as something equivalent). 486 (what you put in comes out as something equivalent).
326 A JSON string becomes a string scalar in Perl - Unicode codepoints 502 A JSON string becomes a string scalar in Perl - Unicode codepoints
327 in JSON are represented by the same codepoints in the Perl string, 503 in JSON are represented by the same codepoints in the Perl string,
328 so no manual decoding is necessary. 504 so no manual decoding is necessary.
329 505
330 number 506 number
331 A JSON number becomes either an integer or numeric (floating point) 507 A JSON number becomes either an integer, numeric (floating point) or
332 scalar in perl, depending on its range and any fractional parts. On 508 string scalar in perl, depending on its range and any fractional
333 the Perl level, there is no difference between those as Perl handles 509 parts. On the Perl level, there is no difference between those as
334 all the conversion details, but an integer may take slightly less 510 Perl handles all the conversion details, but an integer may take
335 memory and might represent more values exactly than (floating point) 511 slightly less memory and might represent more values exactly than
336 numbers. 512 (floating point) numbers.
513
514 If the number consists of digits only, JSON::XS will try to
515 represent it as an integer value. If that fails, it will try to
516 represent it as a numeric (floating point) value if that is possible
517 without loss of precision. Otherwise it will preserve the number as
518 a string value.
519
520 Numbers containing a fractional or exponential part will always be
521 represented as numeric (floating point) values, possibly at a loss
522 of precision.
523
524 This might create round-tripping problems as numbers might become
525 strings, but as Perl is typeless there is no other way to do it.
337 526
338 true, false 527 true, false
339 These JSON atoms become 0, 1, respectively. Information is lost in 528 These JSON atoms become "JSON::XS::true" and "JSON::XS::false",
340 this process. Future versions might represent those values 529 respectively. They are overloaded to act almost exactly like the
341 differently, but they will be guarenteed to act like these integers 530 numbers 1 and 0. You can check wether a scalar is a JSON boolean by
342 would normally in Perl. 531 using the "JSON::XS::is_bool" function.
343 532
344 null 533 null
345 A JSON null atom becomes "undef" in Perl. 534 A JSON null atom becomes "undef" in Perl.
346 535
347 PERL -> JSON 536 PERL -> JSON
371 can also use "JSON::XS::false" and "JSON::XS::true" to improve 560 can also use "JSON::XS::false" and "JSON::XS::true" to improve
372 readability. 561 readability.
373 562
374 to_json [\0,JSON::XS::true] # yields [false,true] 563 to_json [\0,JSON::XS::true] # yields [false,true]
375 564
565 JSON::XS::true, JSON::XS::false
566 These special values become JSON true and JSON false values,
567 respectively. You cna alos use "\1" and "\0" directly if you want.
568
376 blessed objects 569 blessed objects
377 Blessed objects are not allowed. JSON::XS currently tries to encode 570 Blessed objects are not allowed. JSON::XS currently tries to encode
378 their underlying representation (hash- or arrayref), but this 571 their underlying representation (hash- or arrayref), but this
379 behaviour might change in future versions. 572 behaviour might change in future versions.
380 573
410 $x += 0; # numify it, ensuring it will be dumped as a number 603 $x += 0; # numify it, ensuring it will be dumped as a number
411 $x *= 1; # same thing, the choise is yours. 604 $x *= 1; # same thing, the choise is yours.
412 605
413 You can not currently output JSON booleans or force the type in 606 You can not currently output JSON booleans or force the type in
414 other, less obscure, ways. Tell me if you need this capability. 607 other, less obscure, ways. Tell me if you need this capability.
415
416 circular data structures
417 Those will be encoded until memory or stackspace runs out.
418 608
419COMPARISON 609COMPARISON
420 As already mentioned, this module was created because none of the 610 As already mentioned, this module was created because none of the
421 existing JSON modules could be made to work correctly. First I will 611 existing JSON modules could be made to work correctly. First I will
422 describe the problems (or pleasures) I encountered with various existing 612 describe the problems (or pleasures) I encountered with various existing
493 Does not generate valid JSON texts (key strings are often unquoted, 683 Does not generate valid JSON texts (key strings are often unquoted,
494 empty keys result in nothing being output) 684 empty keys result in nothing being output)
495 685
496 Does not check input for validity. 686 Does not check input for validity.
497 687
688 JSON and YAML
689 You often hear that JSON is a subset (or a close subset) of YAML. This
690 is, however, a mass hysteria and very far from the truth. In general,
691 there is no way to configure JSON::XS to output a data structure as
692 valid YAML.
693
694 If you really must use JSON::XS to generate YAML, you should use this
695 algorithm (subject to change in future versions):
696
697 my $to_yaml = JSON::XS->new->utf8->space_after (1);
698 my $yaml = $to_yaml->encode ($ref) . "\n";
699
700 This will usually generate JSON texts that also parse as valid YAML.
701 Please note that YAML has hardcoded limits on (simple) object key
702 lengths that JSON doesn't have, so you should make sure that your hash
703 keys are noticably shorter than the 1024 characters YAML allows.
704
705 There might be other incompatibilities that I am not aware of. In
706 general you should not try to generate YAML with a JSON generator or
707 vice versa, or try to parse JSON with a YAML parser or vice versa:
708 chances are high that you will run into severe interoperability
709 problems.
710
498 SPEED 711 SPEED
499 It seems that JSON::XS is surprisingly fast, as shown in the following 712 It seems that JSON::XS is surprisingly fast, as shown in the following
500 tables. They have been generated with the help of the "eg/bench" program 713 tables. They have been generated with the help of the "eg/bench" program
501 in the JSON::XS distribution, to make it easy to compare on your own 714 in the JSON::XS distribution, to make it easy to compare on your own
502 system. 715 system.
503 716
504 First comes a comparison between various modules using a very short JSON 717 First comes a comparison between various modules using a very short
505 string: 718 single-line JSON string:
506 719
507 {"method": "handleMessage", "params": ["user1", "we were just talking"], "id": null} 720 {"method": "handleMessage", "params": ["user1", "we were just talking"], \
721 "id": null, "array":[1,11,234,-5,1e5,1e7, true, false]}
508 722
509 It shows the number of encodes/decodes per second (JSON::XS uses the 723 It shows the number of encodes/decodes per second (JSON::XS uses the
510 functional interface, while JSON::XS/2 uses the OO interface with 724 functional interface, while JSON::XS/2 uses the OO interface with
511 pretty-printing and hashkey sorting enabled). Higher is better: 725 pretty-printing and hashkey sorting enabled, JSON::XS/3 enables shrink).
726 Higher is better:
512 727
728 Storable | 15779.925 | 14169.946 |
729 -----------+------------+------------+
513 module | encode | decode | 730 module | encode | decode |
514 -----------|------------|------------| 731 -----------|------------|------------|
515 JSON | 11488.516 | 7823.035 | 732 JSON | 4990.842 | 4088.813 |
516 JSON::DWIW | 94708.054 | 129094.260 | 733 JSON::DWIW | 51653.990 | 71575.154 |
517 JSON::PC | 63884.157 | 128528.212 | 734 JSON::PC | 65948.176 | 74631.744 |
735 JSON::PP | 8931.652 | 3817.168 |
518 JSON::Syck | 34898.677 | 42096.911 | 736 JSON::Syck | 24877.248 | 27776.848 |
519 JSON::XS | 654027.064 | 396423.669 | 737 JSON::XS | 388361.481 | 227951.304 |
520 JSON::XS/2 | 371564.190 | 371725.613 | 738 JSON::XS/2 | 227951.304 | 218453.333 |
739 JSON::XS/3 | 338250.323 | 218453.333 |
740 Storable | 16500.016 | 135300.129 |
521 -----------+------------+------------+ 741 -----------+------------+------------+
522 742
523 That is, JSON::XS is more than six times faster than JSON::DWIW on 743 That is, JSON::XS is about five times faster than JSON::DWIW on
524 encoding, more than three times faster on decoding, and about thirty 744 encoding, about three times faster on decoding, and over fourty times
525 times faster than JSON, even with pretty-printing and key sorting. 745 faster than JSON, even with pretty-printing and key sorting. It also
746 compares favourably to Storable for small amounts of data.
526 747
527 Using a longer test string (roughly 18KB, generated from Yahoo! Locals 748 Using a longer test string (roughly 18KB, generated from Yahoo! Locals
528 search API (http://nanoref.com/yahooapis/mgPdGg): 749 search API (http://nanoref.com/yahooapis/mgPdGg):
529 750
530 module | encode | decode | 751 module | encode | decode |
531 -----------|------------|------------| 752 -----------|------------|------------|
532 JSON | 273.023 | 44.674 | 753 JSON | 55.260 | 34.971 |
533 JSON::DWIW | 1089.383 | 1145.704 | 754 JSON::DWIW | 825.228 | 1082.513 |
534 JSON::PC | 3097.419 | 2393.921 | 755 JSON::PC | 3571.444 | 2394.829 |
535 JSON::Syck | 514.060 | 843.053 | 756 JSON::PP | 210.987 | 32.574 |
536 JSON::XS | 6479.668 | 3636.364 | 757 JSON::Syck | 552.551 | 787.544 |
537 JSON::XS/2 | 3774.221 | 3599.124 | 758 JSON::XS | 5780.463 | 4854.519 |
759 JSON::XS/2 | 3869.998 | 4798.975 |
760 JSON::XS/3 | 5862.880 | 4798.975 |
761 Storable | 4445.002 | 5235.027 |
538 -----------+------------+------------+ 762 -----------+------------+------------+
539 763
540 Again, JSON::XS leads by far. 764 Again, JSON::XS leads by far (except for Storable which non-surprisingly
765 decodes faster).
541 766
542 On large strings containing lots of high unicode characters, some 767 On large strings containing lots of high unicode characters, some
543 modules (such as JSON::PC) seem to decode faster than JSON::XS, but the 768 modules (such as JSON::PC) seem to decode faster than JSON::XS, but the
544 result will be broken due to missing (or wrong) unicode handling. Others 769 result will be broken due to missing (or wrong) unicode handling. Others
545 refuse to decode or encode properly, so it was impossible to prepare a 770 refuse to decode or encode properly, so it was impossible to prepare a
556 Second, you need to avoid resource-starving attacks. That means you 781 Second, you need to avoid resource-starving attacks. That means you
557 should limit the size of JSON texts you accept, or make sure then when 782 should limit the size of JSON texts you accept, or make sure then when
558 your resources run out, thats just fine (e.g. by using a separate 783 your resources run out, thats just fine (e.g. by using a separate
559 process that can crash safely). The size of a JSON text in octets or 784 process that can crash safely). The size of a JSON text in octets or
560 characters is usually a good indication of the size of the resources 785 characters is usually a good indication of the size of the resources
561 required to decode it into a Perl structure. 786 required to decode it into a Perl structure. While JSON::XS can check
787 the size of the JSON text, it might be too late when you already have it
788 in memory, so you might want to check the size before you accept the
789 string.
562 790
563 Third, JSON::XS recurses using the C stack when decoding objects and 791 Third, JSON::XS recurses using the C stack when decoding objects and
564 arrays. The C stack is a limited resource: for instance, on my amd64 792 arrays. The C stack is a limited resource: for instance, on my amd64
565 machine with 8MB of stack size I can decode around 180k nested arrays 793 machine with 8MB of stack size I can decode around 180k nested arrays
566 but only 14k nested JSON objects. If that is exceeded, the program 794 but only 14k nested JSON objects (due to perl itself recursing deeply on
795 croak to free the temporary). If that is exceeded, the program crashes.
567 crashes. Thats why the default nesting limit is set to 4096. If your 796 to be conservative, the default nesting limit is set to 512. If your
568 process has a smaller stack, you should adjust this setting accordingly 797 process has a smaller stack, you should adjust this setting accordingly
569 with the "max_depth" method. 798 with the "max_depth" method.
570 799
571 And last but least, something else could bomb you that I forgot to think 800 And last but least, something else could bomb you that I forgot to think
572 of. In that case, you get to keep the pieces. I am alway sopen for 801 of. In that case, you get to keep the pieces. I am always open for
573 hints, though... 802 hints, though...
803
804 If you are using JSON::XS to return packets to consumption by javascript
805 scripts in a browser you should have a look at
806 <http://jpsykes.com/47/practical-csrf-and-json-security> to see wether
807 you are vulnerable to some common attack vectors (which really are
808 browser design bugs, but it is still you who will have to deal with it,
809 as major browser developers care only for features, not about doing
810 security right).
574 811
575BUGS 812BUGS
576 While the goal of this module is to be correct, that unfortunately does 813 While the goal of this module is to be correct, that unfortunately does
577 not mean its bug-free, only that I think its design is bug-free. It is 814 not mean its bug-free, only that I think its design is bug-free. It is
578 still relatively early in its development. If you keep reporting bugs 815 still relatively early in its development. If you keep reporting bugs

Diff Legend

Removed lines
+ Added lines
< Changed lines
> Changed lines