Live data from Hacker News

Parsing malformed JSON

peteris.rocks

41–50 of 57 posts

Re: Parsing malformed JSON

#41
Or, how I made my service a DDoS target.

It's not just the extra compute, it's the lack of a formal specification. If different services applied this kind of ad hoc "postel's principle" they may parse the malformed markup differently, and end up introducing downstream inconsistencies.

Re: Parsing malformed JSON

#42

Please don't do things like this. It only encourages people to be lazy about producing conforming documents, and different parsers that try to compensate for syntax errors are going to do so in different ways. We learnt this the hard way with HTML.

Exactly. When you design for sloppy inputs, you're vulnerable to malicious inputs.

Re: Parsing malformed JSON

#43
post #31

Why would a JSON file be GBs in size? I think that's the more interesting question.

Because it has GBs of data? There's no size limit on JSON.

I think nom-nom is trying to imply that if you're passing GBs of Json around, "human readability" isn't probably a concern. Therefore you could go for an efficient binary format.

Re: Parsing malformed JSON

#44
Many people here wondering how you can end up with JSON this bad, and who is "sending" it to them. Well, the poster is not neccessarily running a REST service. At work, I've dealt with plenty of little JSON (and XML) files, created by "little tools" and passed around via files and pipes. Since I work in science, most of our coders are the users of their code, so you can imagine both code quality and UX are poor. And the main reason something like this happens is that people don't use proper serialization, because they never heard of it, or they don't have the right tools. They just construct JSON by string interpolation. If they are lucky, they remember to replace `'` with `\"`. In fact, that looks a lot like what happened here (plus one or two levels of escaping).

Appropos escaping, people are most likely to do this if they never wrote PHP websites as kids and never went through `urlencode` and `mysql_escape_string` hell.

Re: Parsing malformed JSON

#45
post #7

Great, after the tag soup of modern browsers are we now also going to see json soup? Sometimes it's obvious what's wrong with malformed data you receive. A classic would be encoding errors. But as soon as you start supporting broken components and APIs, you will never be able to unsupport it. Prime example would be HTML. Granted, in the beginning, it was supposed to be written by humans but that was rather quickly no…

I've written a relatively popular Atom/RSS feed parser for Go [0]. I struggled with this very issue but I ultimately ended up attempting to be robust against out-of-spec feeds. A super strict feed parsing library is less useful than one that can successfully parse certain classes of broken feeds. It is a fine line to walk -- I won't add a great deal of complexity to support overly broken feeds, but if it is relativel…

I know that, a long time ago I wrote an HTML parser that tried to make the most sense out of any HTML you threw at it. At one point, it was used to parse most of the Chinese websites there were at the time to find neologisms.

So it was pretty robust but yeah, somewhere you should draw the line.

I think, as long as it doesn't compromise the design of your program (for example, parsing rfc822 dates with localized weekdays) it's fine to be a bit lenient in what you accept.

Anything that goes beyond, needs a very good reason.

Re: Parsing malformed JSON

#46

Why would a JSON file be GBs in size? I think that's the more interesting question.

"Why would a JSON file be GBs in size?"

Maps. [0] Geo-cordinate data can consist of tens of thousands of data points. For example, think of a two dimensional space with a co-ordinate grid at regular intervals representing a 20km x 20km city. Then imagine creating an outline of a city road network. Each point a LAT/LON co-ordinate. Then imagine placing thematic data such as known traffic hot spots.

Lots of data.

[0] The author has this post in his blog ~ https://peteris.rocks/blog/openstreetmap-city-blocks-as-geoj...

Re: Parsing malformed JSON

#47

Please don't do things like this. It only encourages people to be lazy about producing conforming documents, and different parsers that try to compensate for syntax errors are going to do so in different ways. We learnt this the hard way with HTML.

I'm not quite seeing who you think would be encouraged here. Bad JSON output is usually created in a rush by someone who didn't test their output. It's unlikely that someone who does test their JSON output would become lazy because a few lenient parsers exist.

Re: Parsing malformed JSON

#48
post #43
post #31

Earlier quoted context omitted.

Because it has GBs of data? There's no size limit on JSON.

I think nom-nom is trying to imply that if you're passing GBs of Json around, "human readability" isn't probably a concern. Therefore you could go for an efficient binary format.

JSON isn't just about human readability, it's about being a 'good enough' standard for data exchange. What binary format would you use that people could parse as reliably as JSON?

Re: Parsing malformed JSON

#49
post #47

Please don't do things like this. It only encourages people to be lazy about producing conforming documents, and different parsers that try to compensate for syntax errors are going to do so in different ways. We learnt this the hard way with HTML.

I'm not quite seeing who you think would be encouraged here. Bad JSON output is usually created in a rush by someone who didn't test their output. It's unlikely that someone who does test their JSON output would become lazy because a few lenient parsers exist.

Once there are parsers accepting bad input, people will inevitably test with those parsers and assume their output is okay.

Re: Parsing malformed JSON

#50

Or, how I made my service a DDoS target. It's not just the extra compute, it's the lack of a formal specification. If different services applied this kind of ad hoc "postel's principle" they may parse the malformed markup differently, and end up introducing downstream inconsistencies.

Or even vulnerabilities. Imagine a scenario where a parser for an authentication engine reads a different value for a given key than the value the authorization logic reads.
Post reply on HN