ViewVC Help
View File | Revision Log | Show Annotations | Download File
/cvs/JSON-XS/XS.pm
(Generate patch)

Comparing JSON-XS/XS.pm (file contents):
Revision 1.1 by root, Thu Mar 22 16:40:16 2007 UTC vs.
Revision 1.42 by root, Thu Jun 14 23:58:57 2007 UTC

4 4
5=head1 SYNOPSIS 5=head1 SYNOPSIS
6 6
7 use JSON::XS; 7 use JSON::XS;
8 8
9 # exported functions, they croak on error
10 # and expect/generate UTF-8
11
12 $utf8_encoded_json_text = to_json $perl_hash_or_arrayref;
13 $perl_hash_or_arrayref = from_json $utf8_encoded_json_text;
14
15 # objToJson and jsonToObj aliases to to_json and from_json
16 # are exported for compatibility to the JSON module,
17 # but should not be used in new code.
18
19 # OO-interface
20
21 $coder = JSON::XS->new->ascii->pretty->allow_nonref;
22 $pretty_printed_unencoded = $coder->encode ($perl_scalar);
23 $perl_scalar = $coder->decode ($unicode_json_text);
24
9=head1 DESCRIPTION 25=head1 DESCRIPTION
10 26
27This module converts Perl data structures to JSON and vice versa. Its
28primary goal is to be I<correct> and its secondary goal is to be
29I<fast>. To reach the latter goal it was written in C.
30
31As this is the n-th-something JSON module on CPAN, what was the reason
32to write yet another JSON module? While it seems there are many JSON
33modules, none of them correctly handle all corner cases, and in most cases
34their maintainers are unresponsive, gone missing, or not listening to bug
35reports for other reasons.
36
37See COMPARISON, below, for a comparison to some other JSON modules.
38
39See MAPPING, below, on how JSON::XS maps perl values to JSON values and
40vice versa.
41
42=head2 FEATURES
43
11=over 4 44=over 4
12 45
46=item * correct unicode handling
47
48This module knows how to handle Unicode, and even documents how and when
49it does so.
50
51=item * round-trip integrity
52
53When you serialise a perl data structure using only datatypes supported
54by JSON, the deserialised data structure is identical on the Perl level.
55(e.g. the string "2.0" doesn't suddenly become "2" just because it looks
56like a number).
57
58=item * strict checking of JSON correctness
59
60There is no guessing, no generating of illegal JSON texts by default,
61and only JSON is accepted as input by default (the latter is a security
62feature).
63
64=item * fast
65
66Compared to other JSON modules, this module compares favourably in terms
67of speed, too.
68
69=item * simple to use
70
71This module has both a simple functional interface as well as an OO
72interface.
73
74=item * reasonably versatile output formats
75
76You can choose between the most compact guarenteed single-line format
77possible (nice for simple line-based protocols), a pure-ascii format
78(for when your transport is not 8-bit clean, still supports the whole
79unicode range), or a pretty-printed format (for when you want to read that
80stuff). Or you can combine those features in whatever way you like.
81
82=back
83
13=cut 84=cut
14 85
15package JSON::XS; 86package JSON::XS;
16 87
88use strict;
89
17BEGIN { 90BEGIN {
18 $VERSION = '0.1'; 91 our $VERSION = '1.24';
19 @ISA = qw(Exporter); 92 our @ISA = qw(Exporter);
20 93
94 our @EXPORT = qw(to_json from_json objToJson jsonToObj);
21 require Exporter; 95 require Exporter;
22 96
23 require XSLoader; 97 require XSLoader;
24 XSLoader::load JSON::XS::, $VERSION; 98 XSLoader::load JSON::XS::, $VERSION;
25} 99}
26 100
27=item 101=head1 FUNCTIONAL INTERFACE
102
103The following convinience methods are provided by this module. They are
104exported by default:
105
106=over 4
107
108=item $json_text = to_json $perl_scalar
109
110Converts the given Perl data structure (a simple scalar or a reference to
111a hash or array) to a UTF-8 encoded, binary string (that is, the string contains
112octets only). Croaks on error.
113
114This function call is functionally identical to:
115
116 $json_text = JSON::XS->new->utf8->encode ($perl_scalar)
117
118except being faster.
119
120=item $perl_scalar = from_json $json_text
121
122The opposite of C<to_json>: expects an UTF-8 (binary) string and tries to
123parse that as an UTF-8 encoded JSON text, returning the resulting simple
124scalar or reference. Croaks on error.
125
126This function call is functionally identical to:
127
128 $perl_scalar = JSON::XS->new->utf8->decode ($json_text)
129
130except being faster.
131
132=back
133
134
135=head1 OBJECT-ORIENTED INTERFACE
136
137The object oriented interface lets you configure your own encoding or
138decoding style, within the limits of supported formats.
139
140=over 4
141
142=item $json = new JSON::XS
143
144Creates a new JSON::XS object that can be used to de/encode JSON
145strings. All boolean flags described below are by default I<disabled>.
146
147The mutators for flags all return the JSON object again and thus calls can
148be chained:
149
150 my $json = JSON::XS->new->utf8->space_after->encode ({a => [1,2]})
151 => {"a": [1, 2]}
152
153=item $json = $json->ascii ([$enable])
154
155If C<$enable> is true (or missing), then the C<encode> method will not
156generate characters outside the code range C<0..127> (which is ASCII). Any
157unicode characters outside that range will be escaped using either a
158single \uXXXX (BMP characters) or a double \uHHHH\uLLLLL escape sequence,
159as per RFC4627. The resulting encoded JSON text can be treated as a native
160unicode string, an ascii-encoded, latin1-encoded or UTF-8 encoded string,
161or any other superset of ASCII.
162
163If C<$enable> is false, then the C<encode> method will not escape Unicode
164characters unless required by the JSON syntax or other flags. This results
165in a faster and more compact format.
166
167The main use for this flag is to produce JSON texts that can be
168transmitted over a 7-bit channel, as the encoded JSON texts will not
169contain any 8 bit characters.
170
171 JSON::XS->new->ascii (1)->encode ([chr 0x10401])
172 => ["\ud801\udc01"]
173
174=item $json = $json->latin1 ([$enable])
175
176If C<$enable> is true (or missing), then the C<encode> method will encode
177the resulting JSON text as latin1 (or iso-8859-1), escaping any characters
178outside the code range C<0..255>. The resulting string can be treated as a
179latin1-encoded JSON text or a native unicode string. The C<decode> method
180will not be affected in any way by this flag, as C<decode> by default
181expects unicode, which is a strict superset of latin1.
182
183If C<$enable> is false, then the C<encode> method will not escape Unicode
184characters unless required by the JSON syntax or other flags.
185
186The main use for this flag is efficiently encoding binary data as JSON
187text, as most octets will not be escaped, resulting in a smaller encoded
188size. The disadvantage is that the resulting JSON text is encoded
189in latin1 (and must correctly be treated as such when storing and
190transfering), a rare encoding for JSON. It is therefore most useful when
191you want to store data structures known to contain binary data efficiently
192in files or databases, not when talking to other JSON encoders/decoders.
193
194 JSON::XS->new->latin1->encode (["\x{89}\x{abc}"]
195 => ["\x{89}\\u0abc"] # (perl syntax, U+abc escaped, U+89 not)
196
197=item $json = $json->utf8 ([$enable])
198
199If C<$enable> is true (or missing), then the C<encode> method will encode
200the JSON result into UTF-8, as required by many protocols, while the
201C<decode> method expects to be handled an UTF-8-encoded string. Please
202note that UTF-8-encoded strings do not contain any characters outside the
203range C<0..255>, they are thus useful for bytewise/binary I/O. In future
204versions, enabling this option might enable autodetection of the UTF-16
205and UTF-32 encoding families, as described in RFC4627.
206
207If C<$enable> is false, then the C<encode> method will return the JSON
208string as a (non-encoded) unicode string, while C<decode> expects thus a
209unicode string. Any decoding or encoding (e.g. to UTF-8 or UTF-16) needs
210to be done yourself, e.g. using the Encode module.
211
212Example, output UTF-16BE-encoded JSON:
213
214 use Encode;
215 $jsontext = encode "UTF-16BE", JSON::XS->new->encode ($object);
216
217Example, decode UTF-32LE-encoded JSON:
218
219 use Encode;
220 $object = JSON::XS->new->decode (decode "UTF-32LE", $jsontext);
221
222=item $json = $json->pretty ([$enable])
223
224This enables (or disables) all of the C<indent>, C<space_before> and
225C<space_after> (and in the future possibly more) flags in one call to
226generate the most readable (or most compact) form possible.
227
228Example, pretty-print some simple structure:
229
230 my $json = JSON::XS->new->pretty(1)->encode ({a => [1,2]})
231 =>
232 {
233 "a" : [
234 1,
235 2
236 ]
237 }
238
239=item $json = $json->indent ([$enable])
240
241If C<$enable> is true (or missing), then the C<encode> method will use a multiline
242format as output, putting every array member or object/hash key-value pair
243into its own line, identing them properly.
244
245If C<$enable> is false, no newlines or indenting will be produced, and the
246resulting JSON text is guarenteed not to contain any C<newlines>.
247
248This setting has no effect when decoding JSON texts.
249
250=item $json = $json->space_before ([$enable])
251
252If C<$enable> is true (or missing), then the C<encode> method will add an extra
253optional space before the C<:> separating keys from values in JSON objects.
254
255If C<$enable> is false, then the C<encode> method will not add any extra
256space at those places.
257
258This setting has no effect when decoding JSON texts. You will also
259most likely combine this setting with C<space_after>.
260
261Example, space_before enabled, space_after and indent disabled:
262
263 {"key" :"value"}
264
265=item $json = $json->space_after ([$enable])
266
267If C<$enable> is true (or missing), then the C<encode> method will add an extra
268optional space after the C<:> separating keys from values in JSON objects
269and extra whitespace after the C<,> separating key-value pairs and array
270members.
271
272If C<$enable> is false, then the C<encode> method will not add any extra
273space at those places.
274
275This setting has no effect when decoding JSON texts.
276
277Example, space_before and indent disabled, space_after enabled:
278
279 {"key": "value"}
280
281=item $json = $json->canonical ([$enable])
282
283If C<$enable> is true (or missing), then the C<encode> method will output JSON objects
284by sorting their keys. This is adding a comparatively high overhead.
285
286If C<$enable> is false, then the C<encode> method will output key-value
287pairs in the order Perl stores them (which will likely change between runs
288of the same script).
289
290This option is useful if you want the same data structure to be encoded as
291the same JSON text (given the same overall settings). If it is disabled,
292the same hash migh be encoded differently even if contains the same data,
293as key-value pairs have no inherent ordering in Perl.
294
295This setting has no effect when decoding JSON texts.
296
297=item $json = $json->allow_nonref ([$enable])
298
299If C<$enable> is true (or missing), then the C<encode> method can convert a
300non-reference into its corresponding string, number or null JSON value,
301which is an extension to RFC4627. Likewise, C<decode> will accept those JSON
302values instead of croaking.
303
304If C<$enable> is false, then the C<encode> method will croak if it isn't
305passed an arrayref or hashref, as JSON texts must either be an object
306or array. Likewise, C<decode> will croak if given something that is not a
307JSON object or array.
308
309Example, encode a Perl scalar as JSON value with enabled C<allow_nonref>,
310resulting in an invalid JSON text:
311
312 JSON::XS->new->allow_nonref->encode ("Hello, World!")
313 => "Hello, World!"
314
315=item $json = $json->shrink ([$enable])
316
317Perl usually over-allocates memory a bit when allocating space for
318strings. This flag optionally resizes strings generated by either
319C<encode> or C<decode> to their minimum size possible. This can save
320memory when your JSON texts are either very very long or you have many
321short strings. It will also try to downgrade any strings to octet-form
322if possible: perl stores strings internally either in an encoding called
323UTF-X or in octet-form. The latter cannot store everything but uses less
324space in general (and some buggy Perl or C code might even rely on that
325internal representation being used).
326
327The actual definition of what shrink does might change in future versions,
328but it will always try to save space at the expense of time.
329
330If C<$enable> is true (or missing), the string returned by C<encode> will
331be shrunk-to-fit, while all strings generated by C<decode> will also be
332shrunk-to-fit.
333
334If C<$enable> is false, then the normal perl allocation algorithms are used.
335If you work with your data, then this is likely to be faster.
336
337In the future, this setting might control other things, such as converting
338strings that look like integers or floats into integers or floats
339internally (there is no difference on the Perl level), saving space.
340
341=item $json = $json->max_depth ([$maximum_nesting_depth])
342
343Sets the maximum nesting level (default C<512>) accepted while encoding
344or decoding. If the JSON text or Perl data structure has an equal or
345higher nesting level then this limit, then the encoder and decoder will
346stop and croak at that point.
347
348Nesting level is defined by number of hash- or arrayrefs that the encoder
349needs to traverse to reach a given point or the number of C<{> or C<[>
350characters without their matching closing parenthesis crossed to reach a
351given character in a string.
352
353Setting the maximum depth to one disallows any nesting, so that ensures
354that the object is only a single hash/object or array.
355
356The argument to C<max_depth> will be rounded up to the next nearest power
357of two.
358
359See SECURITY CONSIDERATIONS, below, for more info on why this is useful.
360
361=item $json_text = $json->encode ($perl_scalar)
362
363Converts the given Perl data structure (a simple scalar or a reference
364to a hash or array) to its JSON representation. Simple scalars will be
365converted into JSON string or number sequences, while references to arrays
366become JSON arrays and references to hashes become JSON objects. Undefined
367Perl values (e.g. C<undef>) become JSON C<null> values. Neither C<true>
368nor C<false> values will be generated.
369
370=item $perl_scalar = $json->decode ($json_text)
371
372The opposite of C<encode>: expects a JSON text and tries to parse it,
373returning the resulting simple scalar or reference. Croaks on error.
374
375JSON numbers and strings become simple Perl scalars. JSON arrays become
376Perl arrayrefs and JSON objects become Perl hashrefs. C<true> becomes
377C<1>, C<false> becomes C<0> and C<null> becomes C<undef>.
378
379=item ($perl_scalar, $characters) = $json->decode_prefix ($json_text)
380
381This works like the C<decode> method, but instead of raising an exception
382when there is trailing garbage after the first JSON object, it will
383silently stop parsing there and return the number of characters consumed
384so far.
385
386This is useful if your JSON texts are not delimited by an outer protocol
387(which is not the brightest thing to do in the first place) and you need
388to know where the JSON text ends.
389
390 JSON::XS->new->decode_prefix ("[1] the tail")
391 => ([], 3)
392
393=back
394
395
396=head1 MAPPING
397
398This section describes how JSON::XS maps Perl values to JSON values and
399vice versa. These mappings are designed to "do the right thing" in most
400circumstances automatically, preserving round-tripping characteristics
401(what you put in comes out as something equivalent).
402
403For the more enlightened: note that in the following descriptions,
404lowercase I<perl> refers to the Perl interpreter, while uppcercase I<Perl>
405refers to the abstract Perl language itself.
406
407
408=head2 JSON -> PERL
409
410=over 4
411
412=item object
413
414A JSON object becomes a reference to a hash in Perl. No ordering of object
415keys is preserved (JSON does not preserver object key ordering itself).
416
417=item array
418
419A JSON array becomes a reference to an array in Perl.
420
421=item string
422
423A JSON string becomes a string scalar in Perl - Unicode codepoints in JSON
424are represented by the same codepoints in the Perl string, so no manual
425decoding is necessary.
426
427=item number
428
429A JSON number becomes either an integer or numeric (floating point)
430scalar in perl, depending on its range and any fractional parts. On the
431Perl level, there is no difference between those as Perl handles all the
432conversion details, but an integer may take slightly less memory and might
433represent more values exactly than (floating point) numbers.
434
435=item true, false
436
437These JSON atoms become C<0>, C<1>, respectively. Information is lost in
438this process. Future versions might represent those values differently,
439but they will be guarenteed to act like these integers would normally in
440Perl.
441
442=item null
443
444A JSON null atom becomes C<undef> in Perl.
445
446=back
447
448
449=head2 PERL -> JSON
450
451The mapping from Perl to JSON is slightly more difficult, as Perl is a
452truly typeless language, so we can only guess which JSON type is meant by
453a Perl value.
454
455=over 4
456
457=item hash references
458
459Perl hash references become JSON objects. As there is no inherent ordering
460in hash keys (or JSON objects), they will usually be encoded in a
461pseudo-random order that can change between runs of the same program but
462stays generally the same within a single run of a program. JSON::XS can
463optionally sort the hash keys (determined by the I<canonical> flag), so
464the same datastructure will serialise to the same JSON text (given same
465settings and version of JSON::XS), but this incurs a runtime overhead
466and is only rarely useful, e.g. when you want to compare some JSON text
467against another for equality.
468
469=item array references
470
471Perl array references become JSON arrays.
472
473=item other references
474
475Other unblessed references are generally not allowed and will cause an
476exception to be thrown, except for references to the integers C<0> and
477C<1>, which get turned into C<false> and C<true> atoms in JSON. You can
478also use C<JSON::XS::false> and C<JSON::XS::true> to improve readability.
479
480 to_json [\0,JSON::XS::true] # yields [false,true]
481
482=item blessed objects
483
484Blessed objects are not allowed. JSON::XS currently tries to encode their
485underlying representation (hash- or arrayref), but this behaviour might
486change in future versions.
487
488=item simple scalars
489
490Simple Perl scalars (any scalar that is not a reference) are the most
491difficult objects to encode: JSON::XS will encode undefined scalars as
492JSON null value, scalars that have last been used in a string context
493before encoding as JSON strings and anything else as number value:
494
495 # dump as number
496 to_json [2] # yields [2]
497 to_json [-3.0e17] # yields [-3e+17]
498 my $value = 5; to_json [$value] # yields [5]
499
500 # used as string, so dump as string
501 print $value;
502 to_json [$value] # yields ["5"]
503
504 # undef becomes null
505 to_json [undef] # yields [null]
506
507You can force the type to be a string by stringifying it:
508
509 my $x = 3.1; # some variable containing a number
510 "$x"; # stringified
511 $x .= ""; # another, more awkward way to stringify
512 print $x; # perl does it for you, too, quite often
513
514You can force the type to be a number by numifying it:
515
516 my $x = "3"; # some variable containing a string
517 $x += 0; # numify it, ensuring it will be dumped as a number
518 $x *= 1; # same thing, the choise is yours.
519
520You can not currently output JSON booleans or force the type in other,
521less obscure, ways. Tell me if you need this capability.
522
523=back
524
525
526=head1 COMPARISON
527
528As already mentioned, this module was created because none of the existing
529JSON modules could be made to work correctly. First I will describe the
530problems (or pleasures) I encountered with various existing JSON modules,
531followed by some benchmark values. JSON::XS was designed not to suffer
532from any of these problems or limitations.
533
534=over 4
535
536=item JSON 1.07
537
538Slow (but very portable, as it is written in pure Perl).
539
540Undocumented/buggy Unicode handling (how JSON handles unicode values is
541undocumented. One can get far by feeding it unicode strings and doing
542en-/decoding oneself, but unicode escapes are not working properly).
543
544No roundtripping (strings get clobbered if they look like numbers, e.g.
545the string C<2.0> will encode to C<2.0> instead of C<"2.0">, and that will
546decode into the number 2.
547
548=item JSON::PC 0.01
549
550Very fast.
551
552Undocumented/buggy Unicode handling.
553
554No roundtripping.
555
556Has problems handling many Perl values (e.g. regex results and other magic
557values will make it croak).
558
559Does not even generate valid JSON (C<{1,2}> gets converted to C<{1:2}>
560which is not a valid JSON text.
561
562Unmaintained (maintainer unresponsive for many months, bugs are not
563getting fixed).
564
565=item JSON::Syck 0.21
566
567Very buggy (often crashes).
568
569Very inflexible (no human-readable format supported, format pretty much
570undocumented. I need at least a format for easy reading by humans and a
571single-line compact format for use in a protocol, and preferably a way to
572generate ASCII-only JSON texts).
573
574Completely broken (and confusingly documented) Unicode handling (unicode
575escapes are not working properly, you need to set ImplicitUnicode to
576I<different> values on en- and decoding to get symmetric behaviour).
577
578No roundtripping (simple cases work, but this depends on wether the scalar
579value was used in a numeric context or not).
580
581Dumping hashes may skip hash values depending on iterator state.
582
583Unmaintained (maintainer unresponsive for many months, bugs are not
584getting fixed).
585
586Does not check input for validity (i.e. will accept non-JSON input and
587return "something" instead of raising an exception. This is a security
588issue: imagine two banks transfering money between each other using
589JSON. One bank might parse a given non-JSON request and deduct money,
590while the other might reject the transaction with a syntax error. While a
591good protocol will at least recover, that is extra unnecessary work and
592the transaction will still not succeed).
593
594=item JSON::DWIW 0.04
595
596Very fast. Very natural. Very nice.
597
598Undocumented unicode handling (but the best of the pack. Unicode escapes
599still don't get parsed properly).
600
601Very inflexible.
602
603No roundtripping.
604
605Does not generate valid JSON texts (key strings are often unquoted, empty keys
606result in nothing being output)
607
608Does not check input for validity.
609
610=back
611
612
613=head2 JSON and YAML
614
615You often hear that JSON is a subset (or a close subset) of YAML. This is,
616however, a mass hysteria and very far from the truth. In general, there is
617no way to configure JSON::XS to output a data structure as valid YAML.
618
619If you really must use JSON::XS to generate YAML, you should use this
620algorithm (subject to change in future versions):
621
622 my $to_yaml = JSON::XS->new->utf8->space_after (1);
623 my $yaml = $to_yaml->encode ($ref) . "\n";
624
625This will usually generate JSON texts that also parse as valid
626YAML. Please note that YAML has hardcoded limits on (simple) object key
627lengths that JSON doesn't have, so you should make sure that your hash
628keys are noticably shorter than the 1024 characters YAML allows.
629
630There might be other incompatibilities that I am not aware of. In general
631you should not try to generate YAML with a JSON generator or vice versa,
632or try to parse JSON with a YAML parser or vice versa: chances are high
633that you will run into severe interoperability problems.
634
635
636=head2 SPEED
637
638It seems that JSON::XS is surprisingly fast, as shown in the following
639tables. They have been generated with the help of the C<eg/bench> program
640in the JSON::XS distribution, to make it easy to compare on your own
641system.
642
643First comes a comparison between various modules using a very short
644single-line JSON string:
645
646 {"method": "handleMessage", "params": ["user1", "we were just talking"], \
647 "id": null, "array":[1,11,234,-5,1e5,1e7, true, false]}
648
649It shows the number of encodes/decodes per second (JSON::XS uses
650the functional interface, while JSON::XS/2 uses the OO interface
651with pretty-printing and hashkey sorting enabled, JSON::XS/3 enables
652shrink). Higher is better:
653
654 module | encode | decode |
655 -----------|------------|------------|
656 JSON | 7645.468 | 4208.613 |
657 JSON::DWIW | 40721.398 | 77101.176 |
658 JSON::PC | 65948.176 | 78251.940 |
659 JSON::Syck | 22844.793 | 26479.192 |
660 JSON::XS | 388361.481 | 199728.762 |
661 JSON::XS/2 | 218453.333 | 192399.266 |
662 JSON::XS/3 | 338250.323 | 192399.266 |
663 Storable | 15779.925 | 14169.946 |
664 -----------+------------+------------+
665
666That is, JSON::XS is about five times faster than JSON::DWIW on encoding,
667about three times faster on decoding, and over fourty times faster
668than JSON, even with pretty-printing and key sorting. It also compares
669favourably to Storable for small amounts of data.
670
671Using a longer test string (roughly 18KB, generated from Yahoo! Locals
672search API (http://nanoref.com/yahooapis/mgPdGg):
673
674 module | encode | decode |
675 -----------|------------|------------|
676 JSON | 254.685 | 37.665 |
677 JSON::DWIW | 843.343 | 1049.731 |
678 JSON::PC | 3602.116 | 2307.352 |
679 JSON::Syck | 505.107 | 787.899 |
680 JSON::XS | 5747.196 | 3690.220 |
681 JSON::XS/2 | 3968.121 | 3676.634 |
682 JSON::XS/3 | 6105.246 | 3662.508 |
683 Storable | 4417.337 | 5285.161 |
684 -----------+------------+------------+
685
686Again, JSON::XS leads by far (except for Storable which non-surprisingly
687decodes faster).
688
689On large strings containing lots of high unicode characters, some modules
690(such as JSON::PC) seem to decode faster than JSON::XS, but the result
691will be broken due to missing (or wrong) unicode handling. Others refuse
692to decode or encode properly, so it was impossible to prepare a fair
693comparison table for that case.
694
695
696=head1 SECURITY CONSIDERATIONS
697
698When you are using JSON in a protocol, talking to untrusted potentially
699hostile creatures requires relatively few measures.
700
701First of all, your JSON decoder should be secure, that is, should not have
702any buffer overflows. Obviously, this module should ensure that and I am
703trying hard on making that true, but you never know.
704
705Second, you need to avoid resource-starving attacks. That means you should
706limit the size of JSON texts you accept, or make sure then when your
707resources run out, thats just fine (e.g. by using a separate process that
708can crash safely). The size of a JSON text in octets or characters is
709usually a good indication of the size of the resources required to decode
710it into a Perl structure.
711
712Third, JSON::XS recurses using the C stack when decoding objects and
713arrays. The C stack is a limited resource: for instance, on my amd64
714machine with 8MB of stack size I can decode around 180k nested arrays but
715only 14k nested JSON objects (due to perl itself recursing deeply on croak
716to free the temporary). If that is exceeded, the program crashes. to be
717conservative, the default nesting limit is set to 512. If your process
718has a smaller stack, you should adjust this setting accordingly with the
719C<max_depth> method.
720
721And last but least, something else could bomb you that I forgot to think
722of. In that case, you get to keep the pieces. I am always open for hints,
723though...
724
725If you are using JSON::XS to return packets to consumption
726by javascript scripts in a browser you should have a look at
727L<http://jpsykes.com/47/practical-csrf-and-json-security> to see wether
728you are vulnerable to some common attack vectors (which really are browser
729design bugs, but it is still you who will have to deal with it, as major
730browser developers care only for features, not about doing security
731right).
732
733
734=head1 BUGS
735
736While the goal of this module is to be correct, that unfortunately does
737not mean its bug-free, only that I think its design is bug-free. It is
738still relatively early in its development. If you keep reporting bugs they
739will be fixed swiftly, though.
28 740
29=cut 741=cut
30 742
31use JSON::DWIW; 743sub true() { \1 }
32use Benchmark; 744sub false() { \0 }
33
34use utf8;
35#my $json = '{"ü":1,"a":[1,{"3":4},2],"b":5,"üü":2}';
36my $json = '{"test":9555555555555555555,"hu" : -1e+5, "arr" : [ 1,2,3,4,5]}';
37
38my $js = JSON::XS->new;
39warn $js->indent (0);
40warn $js->canonical (0);
41warn $js->ascii (0);
42warn $js->space_after (0);
43use Data::Dumper;
44warn Dumper $js->decode ($json);
45warn Dumper $js->encode ($js->decode ($json));
46#my $x = {"üü" => 2, "ü" => 1, "a" => [1,{3,4},2], b => 5};
47
48#my $js2 = JSON::DWIW->new;
49#
50#timethese 200000, {
51# a => sub { $js->encode ($x) },
52# b => sub { $js2->to_json ($x) },
53#};
54 745
551; 7461;
56
57=back
58 747
59=head1 AUTHOR 748=head1 AUTHOR
60 749
61 Marc Lehmann <schmorp@schmorp.de> 750 Marc Lehmann <schmorp@schmorp.de>
62 http://home.schmorp.de/ 751 http://home.schmorp.de/

Diff Legend

Removed lines
+ Added lines
< Changed lines
> Changed lines