Nicolas Seriot

This article/blog post [1] has been on HN several times before, but it is well worth a reminder. [1] https://seriot.ch/software/parsing_json.html

> The JSON spec fits on two screen pages https://www.json.org/json-en.html The beloved minimalist spec. . No way anything could be wrong with that: https://seriot.ch/projects/parsing_json.html Turns out there are at least half a dozen more specs. trying and failing to clarify that mess.

Amazing! And just in time when the novelty of playing chess in Postscript (https://seriot.ch/projects/pschess.html) has worn off :)

To be fair - J2EE (and its associated technologies like SOAP, XML) is a bit like alcohol. It is great when used in moderation, but gives you headaches when used excessively. XML is great - if you don't believe it, then you might be interested in the pains of parsing JSON: http://seriot.ch/projects/parsing_json.html And don't get me started on YAML...

JSON parsing is a minefield, especially in cross-platforms scenarios (language and/or library). You won't encounter those problems on toy project or simple CRUD applications. For example, as soon as you deal with (u)int64 where values are greater than 2^53, a simple round-trip to javascript can wreak silent havoc. See http://seriot.ch/projects/parsing_json.html Protobuf support for google's first-class citizen languages is usually very good, i.e. C++, Java, Python and Go. For other languages, it depends on each implementation.

JSON is not a simple format. I don't feel confident enough to recommend anything in particular, but I believe one of the well-designed binary formats would be a much better choice. I'll just leave this here. https://news.ycombinator.com/item?id=28826600 https://seriot.ch/projects/parsing_json.html

> My opinion only: I love JSON because it lacks so many foot guns of yaml. While true, parsing it is still a minefield because it's very underspecified: http://seriot.ch/projects/parsing_json.html

Are you sure to support the json-standard instead offering the best speed? http://seriot.ch/json/parsing.html

Wow! This was a great practical analysis of existing implementations, besides a great technical overview of the spec(s). Thanks for open sourcing the analysis code[1], and for the extended results[2] [1] https://github.com/nst/JSONTestSuite [2] http://seriot.ch/json/parsing.html

Security is a concern for every layer. It's not magic pixie dust that' can be sprinkled on top of software to renders it secure! A while ago I read a great article about how the Adobe PDF serialization format is nearly impossible to secure because it allows inherently unsafe constructs. For example, it allows cross-references that are basically just arbitrary unaligned pointers. It uses many different alignment and padding algorithms. It has length-prefixed and not-length prefixed sections. Etc, etc... Apparently it was a serious research exercise to make a safe PDF parser, and they only covered a fraction of the full spec! To put things in perspective: Originally, PDF allowed arbitrary code execution as a core feature, allowing the output of shell commands to be used as document content. Most people like the Chromium and Firefox teams have just given up and now parse PDF using a sandboxed JavaScript VM because it's too hard to do it safely with C++. They parse HTML and JavaScript with C++, but not PDF. Think about that. A similar issue caused Log4j, where a "format string parser" contained a vulnerability because it was too flexible and allowed network requests to be triggered by user-controlled data. Even trivial, "surely it must be safe" formats like XML and JSON are riddled with security issues, such as different layers in a microservice architecture having different handling semantics for duplicate keys, null values, etc... This can result in exploits such as…

Again, I think this is based on some starting assumptions about what is an ideal state, and a lot of people would argue they are flawed assumptions. It's easy to get trapped into a context when considering what the ideal solution would look like. People forget this, but ASCII (and therefore UTF-8) already has characters in it for field/record/etc. separation. One increases complexity significantly (and introduces inefficiency) by overloading other characters with their semantics. There are much more simple & efficient ways to demarcate ordered arrays in particular (e.g. simple length prefixed structures). Nulls are highly problematic for any number of reasons that are widely documented, and JSON unfortunately compounds this by having two ways of representing them (explicitly and by omission). One might quibble with the notion that a format that didn't even exist in 2000 doesn't really have two decades worth of applications working on it, but setting that aside, the design constraints of JavaScript and the challenges that have emerged from it are far from ideal. The work arounds that have emerged (the whole Number fiasco, the "standardizing" on UTF-8 while using UTF-16 when escaping, line terminators, the backslash escapign of control characters, the inconsistencies between JSON & JSONP, the binary64 "good interoperability" rule, and comments being disallowed, and of course the various JSON Schema efforts). While I agree that an ideal serialization standard would not…

JSON gets the most important thing right: it's simpler than XML. I probably should have rephrased my comment. I literally mean that it's a decent format, but not a great one. One issue is that it's surprisingly poorly specified: http://seriot.ch/parsing_json.php. As a data-interchange format, it lacks first class dates/timestamps, the issues about specification are a pain when dealing with numbers (depending on language, you may not be able to use the full range of 64 bit ints), and has no builtin concept of schemas. That said, I'm not sure what I'd recommend above JSON, though you clearly wouldn't use it for really high performance servers. It's also used as a configuration language, where more issues surface. It doesn't accept trailing commas or comments (I can see the argument for requiring all keys to be quoted, but that's a pain to write as well). For configuration, I think I prefer TOML to JSON. Dhall looks cool, but I've never used it.

Moving to something else that JSON for this kind of thing is reasonable given the issues with parsing JSON which can cause 2 implementation to interpret it in 2 different ways. https://seriot.ch/security/parsing_json.html

In theory, yes. In practice, there are throngs of parsers and converters who might handle such cases differently. https://seriot.ch/projects/parsing_json.html

You should read that, it's still relevant: https://seriot.ch/projects/parsing_json.html

That _shouldn't_ be ambiguous, `false` is a valid JSON document according to specification, but not all parsers are compliant. There's some interesting examples of ambiguities here: https://seriot.ch/projects/parsing_json.html

Fun to see someone decide to just write a faster JSON parser because they believed it was possible. They mentioned last year that libjansson had some intermediate layer with Emacs, which led to too many memory allocations: https://lists.gnu.org/archive/html/emacs-devel/2024-03/msg00251.html Also, the developer who wrote the parser (Géza Herman) was able to pass all of the tests with strange edge cases from https://seriot.ch/projects/parsing_json.html very quickly: https://lists.gnu.org/archive/html/emacs-devel/2024-03/msg00250.html

Parsing JSON is a Minefield: https://seriot.ch/projects/parsing_json.html

http://seriot.ch/projects/parsing_json.html "Despite the clarifications they bring, RFC 7159 and 8259 contain several approximations and leaves many details loosely specified."

JSON's everything is "indefinite length". Also its implementations are wildly inconsistent [1] (is anyone going to read the code to figure out which is the blessed systemd parser?). Also it doesn't have integers. A lot of things with JSON will deteriorate into stringifying anyway, for example dates. [1]: https://seriot.ch/projects/parsing_json.html

Protobuf can typically be about 70-80% smaller than the equivalent JSON payloads. If you care about Network I/O costs (at a large scale), you'd probably want to realize a benefit in cost savings like that. Additionally, I think people put a lot of trust into JSON parsers across ecosystems "just working", and I think that's something more people should look into (it's worse than you think): https://seriot.ch/projects/parsing_json.html

OP here. Indeed, hardest part is the initial mental gymnastics. This can be overcome by devising and enforcing some conventions that I wrote about in a separate article https://seriot.ch/projects/programming_in_postscript.html

I mean I've always found this enlightening, when hearing json is 'simple': https://seriot.ch/projects/parsing_json.html

# Parsing JSON is a Minefield "The conciseness of the grammar leaves many aspects undefined. On top of that, several specifications exist, and their various interpretations tend to be murky." https://seriot.ch/projects/parsing_json.html

"Parsing json is easy" https://seriot.ch/projects/parsing_json.html https://raw.githubusercontent.com/nst/JSONTestSuite/master/results/pru…

Unfortunately, the problem here is programmers moreso than formats. It literally doesn't matter what you specify, programmers will not implement it to a T. Most programmers simply don't know that every single detail matters. Many of those who may have some idea don't really care, since they can't imagine how something like this could happen. It's not just XML. It's every ecosystem I've ever used. Push it around the edges and you will find things. This is neat, not because it is special to JSON in particular but because it's an example of examining a good chunk of a large ecosystem: https://seriot.ch/projects/parsing_json.html Consider this is likely to be true in any ecosystem that doesn't make it a top priority to avoid.

<https://seriot.ch/projects/parsing_json.html> Much of the implementation divergence is the fault of underspecification (though not all; some of it is just shoddy coding in its own right). The original RFC described only the grammar of JSON, not equivalence of JSON texts or normalization. Later specifications try to paper over that fact by specifying certain interoperability conditions without outright requiring them for conformance.

Using text because it's better than binary format? human readable doesnt not mean the text format is unambiguous. aka don't preform checks/validations because not specification of what to check/validate see https://seriot.ch/projects/parsing_json.html && https://news.ycombinator.com/item?id=28826600 just as messy as ambiguously specified ASN.1 binary formats. Very important to know the requirments/specs for what's being implimented!

Ignoring S-expr based configs for a moment, of the configuration languages, JSON parsing is probably the most straightforward. YAML is a superset of JSON, TOML is probably on par, TS and JS are obviously more complex than JSON, and XML is...XML. All of that is to say, I'd rather write a JSON parser than any of the above. And JSON parsing is a minefield. http://seriot.ch/projects/parsing_json.html I don't know of any notable S-expr based config languages, probably because they are so easy to parse, people just roll their own, leading to balkanization.

It used an off-the-shelf library, I don't remember which one anymore. I don't think it really matters though -- YAML is a format, not a parser. Per the YAML docs [0], "Creating a fully compliant parser has proven almost impossible." Pretty much every YAML parser out there is going to have its own idiosyncratic subset that it handles. That doesn't make the _files_ not-YAML. (This does make YAML a horrible data exchange format. No argument there!) Also, JSON has a similar condition [1]. [0]: https://github.com/yaml/yaml-grammar [1]: http://seriot.ch/projects/parsing_json.html