… | |
… | |
40 | Beginning with version 2.0 of the JSON module, when both JSON and |
40 | Beginning with version 2.0 of the JSON module, when both JSON and |
41 | JSON::XS are installed, then JSON will fall back on JSON::XS (this can be |
41 | JSON::XS are installed, then JSON will fall back on JSON::XS (this can be |
42 | overridden) with no overhead due to emulation (by inheriting constructor |
42 | overridden) with no overhead due to emulation (by inheriting constructor |
43 | and methods). If JSON::XS is not available, it will fall back to the |
43 | and methods). If JSON::XS is not available, it will fall back to the |
44 | compatible JSON::PP module as backend, so using JSON instead of JSON::XS |
44 | compatible JSON::PP module as backend, so using JSON instead of JSON::XS |
45 | gives you a portable JSON API that can be fast when you need and doesn't |
45 | gives you a portable JSON API that can be fast when you need it and |
46 | require a C compiler when that is a problem. |
46 | doesn't require a C compiler when that is a problem. |
47 | |
47 | |
48 | As this is the n-th-something JSON module on CPAN, what was the reason |
48 | As this is the n-th-something JSON module on CPAN, what was the reason |
49 | to write yet another JSON module? While it seems there are many JSON |
49 | to write yet another JSON module? While it seems there are many JSON |
50 | modules, none of them correctly handle all corner cases, and in most cases |
50 | modules, none of them correctly handle all corner cases, and in most cases |
51 | their maintainers are unresponsive, gone missing, or not listening to bug |
51 | their maintainers are unresponsive, gone missing, or not listening to bug |
… | |
… | |
101 | |
101 | |
102 | package JSON::XS; |
102 | package JSON::XS; |
103 | |
103 | |
104 | use common::sense; |
104 | use common::sense; |
105 | |
105 | |
106 | our $VERSION = 3.01; |
106 | our $VERSION = 3.04; |
107 | our @ISA = qw(Exporter); |
107 | our @ISA = qw(Exporter); |
108 | |
108 | |
109 | our @EXPORT = qw(encode_json decode_json); |
109 | our @EXPORT = qw(encode_json decode_json); |
110 | |
110 | |
111 | use Exporter; |
111 | use Exporter; |
… | |
… | |
131 | |
131 | |
132 | Except being faster. |
132 | Except being faster. |
133 | |
133 | |
134 | =item $perl_scalar = decode_json $json_text |
134 | =item $perl_scalar = decode_json $json_text |
135 | |
135 | |
136 | The opposite of C<encode_json>: expects an UTF-8 (binary) string and tries |
136 | The opposite of C<encode_json>: expects a UTF-8 (binary) string and tries |
137 | to parse that as an UTF-8 encoded JSON text, returning the resulting |
137 | to parse that as a UTF-8 encoded JSON text, returning the resulting |
138 | reference. Croaks on error. |
138 | reference. Croaks on error. |
139 | |
139 | |
140 | This function call is functionally identical to: |
140 | This function call is functionally identical to: |
141 | |
141 | |
142 | $perl_scalar = JSON::XS->new->utf8->decode ($json_text) |
142 | $perl_scalar = JSON::XS->new->utf8->decode ($json_text) |
… | |
… | |
270 | |
270 | |
271 | =item $enabled = $json->get_utf8 |
271 | =item $enabled = $json->get_utf8 |
272 | |
272 | |
273 | If C<$enable> is true (or missing), then the C<encode> method will encode |
273 | If C<$enable> is true (or missing), then the C<encode> method will encode |
274 | the JSON result into UTF-8, as required by many protocols, while the |
274 | the JSON result into UTF-8, as required by many protocols, while the |
275 | C<decode> method expects to be handled an UTF-8-encoded string. Please |
275 | C<decode> method expects to be handed a UTF-8-encoded string. Please |
276 | note that UTF-8-encoded strings do not contain any characters outside the |
276 | note that UTF-8-encoded strings do not contain any characters outside the |
277 | range C<0..255>, they are thus useful for bytewise/binary I/O. In future |
277 | range C<0..255>, they are thus useful for bytewise/binary I/O. In future |
278 | versions, enabling this option might enable autodetection of the UTF-16 |
278 | versions, enabling this option might enable autodetection of the UTF-16 |
279 | and UTF-32 encoding families, as described in RFC4627. |
279 | and UTF-32 encoding families, as described in RFC4627. |
280 | |
280 | |
… | |
… | |
697 | |
697 | |
698 | This is useful if your JSON texts are not delimited by an outer protocol |
698 | This is useful if your JSON texts are not delimited by an outer protocol |
699 | and you need to know where the JSON text ends. |
699 | and you need to know where the JSON text ends. |
700 | |
700 | |
701 | JSON::XS->new->decode_prefix ("[1] the tail") |
701 | JSON::XS->new->decode_prefix ("[1] the tail") |
702 | => ([], 3) |
702 | => ([1], 3) |
703 | |
703 | |
704 | =back |
704 | =back |
705 | |
705 | |
706 | |
706 | |
707 | =head1 INCREMENTAL PARSING |
707 | =head1 INCREMENTAL PARSING |
… | |
… | |
748 | C<incr_skip> to skip the erroneous part). This is the most common way of |
748 | C<incr_skip> to skip the erroneous part). This is the most common way of |
749 | using the method. |
749 | using the method. |
750 | |
750 | |
751 | And finally, in list context, it will try to extract as many objects |
751 | And finally, in list context, it will try to extract as many objects |
752 | from the stream as it can find and return them, or the empty list |
752 | from the stream as it can find and return them, or the empty list |
753 | otherwise. For this to work, there must be no separators between the JSON |
753 | otherwise. For this to work, there must be no separators (other than |
754 | objects or arrays, instead they must be concatenated back-to-back. If |
754 | whitespace) between the JSON objects or arrays, instead they must be |
755 | an error occurs, an exception will be raised as in the scalar context |
755 | concatenated back-to-back. If an error occurs, an exception will be |
756 | case. Note that in this case, any previously-parsed JSON texts will be |
756 | raised as in the scalar context case. Note that in this case, any |
757 | lost. |
757 | previously-parsed JSON texts will be lost. |
758 | |
758 | |
759 | Example: Parse some JSON arrays/objects in a given string and return |
759 | Example: Parse some JSON arrays/objects in a given string and return |
760 | them. |
760 | them. |
761 | |
761 | |
762 | my @objs = JSON::XS->new->incr_parse ("[5][7][1,2]"); |
762 | my @objs = JSON::XS->new->incr_parse ("[5][7][1,2]"); |
… | |
… | |
768 | C<incr_parse> in I<scalar context> successfully returned an object. Under |
768 | C<incr_parse> in I<scalar context> successfully returned an object. Under |
769 | all other circumstances you must not call this function (I mean it. |
769 | all other circumstances you must not call this function (I mean it. |
770 | although in simple tests it might actually work, it I<will> fail under |
770 | although in simple tests it might actually work, it I<will> fail under |
771 | real world conditions). As a special exception, you can also call this |
771 | real world conditions). As a special exception, you can also call this |
772 | method before having parsed anything. |
772 | method before having parsed anything. |
|
|
773 | |
|
|
774 | That means you can only use this function to look at or manipulate text |
|
|
775 | before or after complete JSON objects, not while the parser is in the |
|
|
776 | middle of parsing a JSON object. |
773 | |
777 | |
774 | This function is useful in two cases: a) finding the trailing text after a |
778 | This function is useful in two cases: a) finding the trailing text after a |
775 | JSON object or b) parsing multiple JSON objects separated by non-JSON text |
779 | JSON object or b) parsing multiple JSON objects separated by non-JSON text |
776 | (such as commas). |
780 | (such as commas). |
777 | |
781 | |
… | |
… | |
1285 | expect your input strings to be encoded as UTF-8, that is, no "character" |
1289 | expect your input strings to be encoded as UTF-8, that is, no "character" |
1286 | of the input string must have any value > 255, as UTF-8 does not allow |
1290 | of the input string must have any value > 255, as UTF-8 does not allow |
1287 | that. |
1291 | that. |
1288 | |
1292 | |
1289 | The C<utf8> flag therefore switches between two modes: disabled means you |
1293 | The C<utf8> flag therefore switches between two modes: disabled means you |
1290 | will get a Unicode string in Perl, enabled means you get an UTF-8 encoded |
1294 | will get a Unicode string in Perl, enabled means you get a UTF-8 encoded |
1291 | octet/binary string in Perl. |
1295 | octet/binary string in Perl. |
1292 | |
1296 | |
1293 | =item C<latin1> or C<ascii> flags enabled |
1297 | =item C<latin1> or C<ascii> flags enabled |
1294 | |
1298 | |
1295 | With C<latin1> (or C<ascii>) enabled, C<encode> will escape characters |
1299 | With C<latin1> (or C<ascii>) enabled, C<encode> will escape characters |
… | |
… | |
1563 | are browser design bugs, but it is still you who will have to deal with |
1567 | are browser design bugs, but it is still you who will have to deal with |
1564 | it, as major browser developers care only for features, not about getting |
1568 | it, as major browser developers care only for features, not about getting |
1565 | security right). |
1569 | security right). |
1566 | |
1570 | |
1567 | |
1571 | |
|
|
1572 | =head1 "OLD" VS. "NEW" JSON (RFC 4627 VS. RFC 7159) |
|
|
1573 | |
|
|
1574 | TL;DR: Due to security concerns, JSON::XS will not allow scalar data in |
|
|
1575 | JSON texts by default - you need to create your own JSON::XS object and |
|
|
1576 | enable C<allow_nonref>: |
|
|
1577 | |
|
|
1578 | |
|
|
1579 | my $json = JSON::XS->new->allow_nonref; |
|
|
1580 | |
|
|
1581 | $text = $json->encode ($data); |
|
|
1582 | $data = $json->decode ($text); |
|
|
1583 | |
|
|
1584 | The long version: JSON being an important and supposedly stable format, |
|
|
1585 | the IETF standardised it as RFC 4627 in 2006. Unfortunately, the inventor |
|
|
1586 | of JSON, Dougles Crockford, unilaterally changed the definition of JSON in |
|
|
1587 | javascript. Rather than create a fork, the IETF decided to standardise the |
|
|
1588 | new syntax (apparently, so Iw as told, without finding it very amusing). |
|
|
1589 | |
|
|
1590 | The biggest difference between thed original JSON and the new JSON is that |
|
|
1591 | the new JSON supports scalars (anything other than arrays and objects) at |
|
|
1592 | the toplevel of a JSON text. While this is strictly backwards compatible |
|
|
1593 | to older versions, it breaks a number of protocols that relied on sending |
|
|
1594 | JSON back-to-back, and is a minor security concern. |
|
|
1595 | |
|
|
1596 | For example, imagine you have two banks communicating, and on one side, |
|
|
1597 | trhe JSON coder gets upgraded. Two messages, such as C<10> and C<1000> |
|
|
1598 | might then be confused to mean C<101000>, something that couldn't happen |
|
|
1599 | in the original JSON, because niether of these messages would be valid |
|
|
1600 | JSON. |
|
|
1601 | |
|
|
1602 | If one side accepts these messages, then an upgrade in the coder on either |
|
|
1603 | side could result in this becoming exploitable. |
|
|
1604 | |
|
|
1605 | This module has always allowed these messages as an optional extension, by |
|
|
1606 | default disabled. The security concerns are the reason why the default is |
|
|
1607 | still disabled, but future versions might/will likely upgrade to the newer |
|
|
1608 | RFC as default format, so you are advised to check your implementation |
|
|
1609 | and/or override the default with C<< ->allow_nonref (0) >> to ensure that |
|
|
1610 | future versions are safe. |
|
|
1611 | |
|
|
1612 | |
1568 | =head1 INTEROPERABILITY WITH OTHER MODULES |
1613 | =head1 INTEROPERABILITY WITH OTHER MODULES |
1569 | |
1614 | |
1570 | C<JSON::XS> uses the L<Types::Serialiser> module to provide boolean |
1615 | C<JSON::XS> uses the L<Types::Serialiser> module to provide boolean |
1571 | constants. That means that the JSON true and false values will be |
1616 | constants. That means that the JSON true and false values will be |
1572 | comaptible to true and false values of iother modules that do the same, |
1617 | comaptible to true and false values of other modules that do the same, |
1573 | such as L<JSON::PP> and L<CBOR::XS>. |
1618 | such as L<JSON::PP> and L<CBOR::XS>. |
1574 | |
1619 | |
1575 | |
1620 | |
1576 | =head1 INTEROPERABILITY WITH OTHER JSON DECODERS |
1621 | =head1 INTEROPERABILITY WITH OTHER JSON DECODERS |
1577 | |
1622 | |
… | |
… | |
1594 | |
1639 | |
1595 | When you use C<allow_tags> to use the extended (and also nonstandard and |
1640 | When you use C<allow_tags> to use the extended (and also nonstandard and |
1596 | invalid) JSON syntax for serialised objects, and you still want to decode |
1641 | invalid) JSON syntax for serialised objects, and you still want to decode |
1597 | the generated When you want to serialise objects, you can run a regex |
1642 | the generated When you want to serialise objects, you can run a regex |
1598 | to replace the tagged syntax by standard JSON arrays (it only works for |
1643 | to replace the tagged syntax by standard JSON arrays (it only works for |
1599 | "normal" packagesnames without comma, newlines or single colons). First, |
1644 | "normal" package names without comma, newlines or single colons). First, |
1600 | the readable Perl version: |
1645 | the readable Perl version: |
1601 | |
1646 | |
1602 | # if your FREEZE methods return no values, you need this replace first: |
1647 | # if your FREEZE methods return no values, you need this replace first: |
1603 | $json =~ s/\( \s* (" (?: [^\\":,]+|\\.|::)* ") \s* \) \s* \[\s*\]/[$1]/gx; |
1648 | $json =~ s/\( \s* (" (?: [^\\":,]+|\\.|::)* ") \s* \) \s* \[\s*\]/[$1]/gx; |
1604 | |
1649 | |
… | |
… | |
1640 | Since this module was written, Google has written a new JSON RFC, RFC 7159 |
1685 | Since this module was written, Google has written a new JSON RFC, RFC 7159 |
1641 | (and RFC7158). Unfortunately, this RFC breaks compatibility with both the |
1686 | (and RFC7158). Unfortunately, this RFC breaks compatibility with both the |
1642 | original JSON specification on www.json.org and RFC4627. |
1687 | original JSON specification on www.json.org and RFC4627. |
1643 | |
1688 | |
1644 | As far as I can see, you can get partial compatibility when parsing by |
1689 | As far as I can see, you can get partial compatibility when parsing by |
1645 | using C<< ->allow_nonref >>. However, consider thew security implications |
1690 | using C<< ->allow_nonref >>. However, consider the security implications |
1646 | of doing so. |
1691 | of doing so. |
1647 | |
1692 | |
1648 | I haven't decided yet when to break compatibility with RFC4627 by default |
1693 | I haven't decided yet when to break compatibility with RFC4627 by default |
1649 | (and potentially leave applications insecure) and change the default to |
1694 | (and potentially leave applications insecure) and change the default to |
1650 | follow RFC7159, but application authors are well advised to call C<< |
1695 | follow RFC7159, but application authors are well advised to call C<< |
1651 | ->allow_nonref(0) >> even if this is the current default, if they cannot |
1696 | ->allow_nonref(0) >> even if this is the current default, if they cannot |
1652 | handle non-reference values, in preparation for the day when the4 default |
1697 | handle non-reference values, in preparation for the day when the default |
1653 | will change. |
1698 | will change. |
1654 | |
1699 | |
1655 | |
1700 | |
1656 | =head1 THREADS |
1701 | =head1 (I-)THREADS |
1657 | |
1702 | |
1658 | This module is I<not> guaranteed to be thread safe and there are no |
1703 | This module is I<not> guaranteed to be ithread (or MULTIPLICITY-) safe |
1659 | plans to change this until Perl gets thread support (as opposed to the |
1704 | and there are no plans to change this. Note that perl's builtin so-called |
1660 | horribly slow so-called "threads" which are simply slow and bloated |
1705 | threads/ithreads are officially deprecated and should not be used. |
1661 | process simulations - use fork, it's I<much> faster, cheaper, better). |
|
|
1662 | |
|
|
1663 | (It might actually work, but you have been warned). |
|
|
1664 | |
1706 | |
1665 | |
1707 | |
1666 | =head1 THE PERILS OF SETLOCALE |
1708 | =head1 THE PERILS OF SETLOCALE |
1667 | |
1709 | |
1668 | Sometimes people avoid the Perl locale support and directly call the |
1710 | Sometimes people avoid the Perl locale support and directly call the |