| … | |
… | |
| 101 | |
101 | |
| 102 | package JSON::XS; |
102 | package JSON::XS; |
| 103 | |
103 | |
| 104 | use common::sense; |
104 | use common::sense; |
| 105 | |
105 | |
| 106 | our $VERSION = 3.01; |
106 | our $VERSION = 3.02; |
| 107 | our @ISA = qw(Exporter); |
107 | our @ISA = qw(Exporter); |
| 108 | |
108 | |
| 109 | our @EXPORT = qw(encode_json decode_json); |
109 | our @EXPORT = qw(encode_json decode_json); |
| 110 | |
110 | |
| 111 | use Exporter; |
111 | use Exporter; |
| … | |
… | |
| 1563 | are browser design bugs, but it is still you who will have to deal with |
1563 | are browser design bugs, but it is still you who will have to deal with |
| 1564 | it, as major browser developers care only for features, not about getting |
1564 | it, as major browser developers care only for features, not about getting |
| 1565 | security right). |
1565 | security right). |
| 1566 | |
1566 | |
| 1567 | |
1567 | |
|
|
1568 | =head1 "OLD" VS. "NEW" JSON (RFC 4627 VS. RFC 7159) |
|
|
1569 | |
|
|
1570 | TL;DR: Due to security concerns, JSON::XS will not allow scalar data in |
|
|
1571 | JSON texts by default - you need to create your own JSON::XS object and |
|
|
1572 | enable C<allow_nonref>: |
|
|
1573 | |
|
|
1574 | |
|
|
1575 | my $json = JSON::XS->new->allow_nonref; |
|
|
1576 | |
|
|
1577 | $text = $json->encode ($data); |
|
|
1578 | $data = $json->decode ($text); |
|
|
1579 | |
|
|
1580 | The long version: JSON being an important and supposedly stable format, |
|
|
1581 | the IETF standardised it as RFC 4627 in 2006. Unfortunately, the inventor |
|
|
1582 | of JSON, Dougles Crockford, unilaterally changed the definition of JSON in |
|
|
1583 | javascript. Rather than create a fork, the IETF decided to standardise the |
|
|
1584 | new syntax (apparently, so Iw as told, without finding it very amusing). |
|
|
1585 | |
|
|
1586 | The biggest difference between thed original JSON and the new JSON is that |
|
|
1587 | the new JSON supports scalars (anything other than arrays and objects) at |
|
|
1588 | the toplevel of a JSON text. While this is strictly backwards compatible |
|
|
1589 | to older versions, it breaks a number of protocols that relied on sending |
|
|
1590 | JSON back-to-back, and is a minor security concern. |
|
|
1591 | |
|
|
1592 | For example, imagine you have two banks communicating, and on one side, |
|
|
1593 | trhe JSON coder gets upgraded. Two messages, such as C<10> and C<1000> |
|
|
1594 | might then be confused to mean C<101000>, something that couldn't happen |
|
|
1595 | in the original JSON, because niether of these messages would be valid |
|
|
1596 | JSON. |
|
|
1597 | |
|
|
1598 | If one side accepts these messages, then an upgrade in the coder on either |
|
|
1599 | side could result in this becoming exploitable. |
|
|
1600 | |
|
|
1601 | This module has always allowed these messages as an optional extension, by |
|
|
1602 | default disabled. The security concerns are the reason why the default is |
|
|
1603 | still disabled, but future versions might/will likely upgrade to the newer |
|
|
1604 | RFC as default format, so you are advised to check your implementation |
|
|
1605 | and/or override the default with C<< ->allow_nonref (0) >> to ensure that |
|
|
1606 | future versions are safe. |
|
|
1607 | |
|
|
1608 | |
| 1568 | =head1 INTEROPERABILITY WITH OTHER MODULES |
1609 | =head1 INTEROPERABILITY WITH OTHER MODULES |
| 1569 | |
1610 | |
| 1570 | C<JSON::XS> uses the L<Types::Serialiser> module to provide boolean |
1611 | C<JSON::XS> uses the L<Types::Serialiser> module to provide boolean |
| 1571 | constants. That means that the JSON true and false values will be |
1612 | constants. That means that the JSON true and false values will be |
| 1572 | comaptible to true and false values of iother modules that do the same, |
1613 | comaptible to true and false values of iother modules that do the same, |
