Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Sj.h: A tiny little JSON parsing library in ~150 lines of C99

github.com

Post reply on HN
Print view View original

181–190 of 248 posts

Re: Sj.h: A tiny little JSON parsing library in ~150 lines of C99

#181

Post by TZubiri »

hypeatei wrote: post #43
layer8 wrote: post #19

The library doesn’t check for signed integer overflow here: https://github.com/rxi/sj.h/blob/eb725e0858877e86932128836c1... https://github.com/rxi/sj.h/blob/eb725e0858877e86932128836c1... https://github.com/rxi/sj.h/blob/eb725e0858877e86932128836c1... Certain inputs can therefore trigger UB.

You're not aware of the simplistic, single header C library culture that some developers like to partake in. Tsoding (a streamer) is a prime example of someone who likes developing/using these types of libraries. They acknowledge that these things aren't focused on "security" or "features" and that's okay. Not everything is a super serious business project exposed to thousands of paying customers.

Either you are :

- overestimating the gravity of a UB and its security implications

- underestimate the value of a 150 line json parser

- or overestimate the feasibility of having both a short and high quality parser.

It sometimes happens that fixing a bug is quicker than defending the low quality. Not everything is a tradeoff.

Re: Sj.h: A tiny little JSON parsing library in ~150 lines of C99

#182

Post by lixtra »

president_zippy wrote: post #168
ethanwillis wrote: post #96

Earlier quoted context omitted.

Why play all these semantic games? You're saying it's the author's problem. You want them to even edit their readme to include warnings for would be production/business users who don't want to pay for it.

[flagged]

Layer8 DID the thing though, skimmed through the code and thought about security issues.

Re: Sj.h: A tiny little JSON parsing library in ~150 lines of C99

#183

Post by leptons »

userbinator wrote: post #125
leptons wrote: post #104

Earlier quoted context omitted.

I controlled both ends. There is nothing "insane" about JSON. It's used far and wide for many purposes. The system sending the JSON was based on Nodejs, so it was pretty natural to use JSON. And I did it with JSON just because I wanted to. I'd have had to invent some other protocol to do it anyway, and I didn't feel like reinventing the wheel when it was quite simple to write a basic JSON parser in assembly language,…

For something that simple I'd choose a custom binary protocol or something like ASN.1 instead of JSON. It's easier to generate from a HLL and parse in a LLL (I've also been writing Asm for a few decades...)

I've done plenty of custom binary protocols before. I can't say they were any better or easier to deal with. I also can't say that the "parser" for a binary format was any easier than a simple, limited JSON parser.

For this specific project I chose JSON and it worked perfectly. Sending JSON from the embedded CPU was also really simple. Yes, there was a little overhead on a slow connection, but I wasn't getting anywhere near saturation. I think it was 9600 bps max on a noisy connection with checksums. If even 10% of the JSON "packets" got through it was still plenty for the system to run.

Re: Sj.h: A tiny little JSON parsing library in ~150 lines of C99

#184

Post by kstenerud »

mbac32768 wrote: post #38
codr7 wrote: post #12

JSON parser libraries in general is a black hole of suffering imo. They're either written with a different use case in mind, or a complex mess of abstractions; often both. It's not a very difficult problem to solve if you only write exactly what you need for your specific use case.

It's astonishing how involved a fucking modern JSON library becomes. The once "very simple" C++ single-header JSON library by nlohmann is now * 13 years old * is still actively merging PRs (last one 5 hours ago) * has 122 __million__ unit tests Despite all this, it's self-admittedly still not the fastest possible way to parse JSON in C++. For that you might want to look into simdjson. Don't start your own JSON parser…

I did write one, but I needed to because the already-written data must be recoverable on a crash (to be able to recover partially written files) since this is in a crash reporter - and also the encoder needs to be async-safe.

https://github.com/kstenerud/KSCrash/blob/master/Sources/KSC...

And yeah, writing a JSON codec sucks.

So I'm in the process of replacing it with a BONJSON codec, which has the same capabilities, is still async-safe and crash resilient, and is 35x faster with less code.

https://github.com/kstenerud/ksbonjson/blob/main/library/src...

https://github.com/kstenerud/ksbonjson/blob/main/library/src...

Re: Sj.h: A tiny little JSON parsing library in ~150 lines of C99

#185

Post by CorrectHorseBat »

Yeask wrote: post #162
CorrectHorseBat wrote: post #68

Earlier quoted context omitted.

A standard clause you can find in every open source license? It doesn't say anything about how serious the project takes security

You write only Rust code don't you?

I wish ;) You're talking about how Rust code usually uses the MIT license and this is a part of the MIT license?

Every open source license has a very similar clause, include but not limited to BSD, GPL, CDDL, MPL and Apache.

Re: Sj.h: A tiny little JSON parsing library in ~150 lines of C99

#186

Post by kstenerud »

vovavili wrote: post #132
mbac32768 wrote: post #38

Earlier quoted context omitted.

It's astonishing how involved a fucking modern JSON library becomes. The once "very simple" C++ single-header JSON library by nlohmann is now * 13 years old * is still actively merging PRs (last one 5 hours ago) * has 122 __million__ unit tests Despite all this, it's self-admittedly still not the fastest possible way to parse JSON in C++. For that you might want to look into simdjson. Don't start your own JSON parser…

I am very surprised to hear the unit testing statistic. What kind of unholy edge cases would JSON parsing require to make it necessary to cover 122 million variations?

The more speed optimizations you put in, the gnarlier the new edge cases that pop up.

Re: Sj.h: A tiny little JSON parsing library in ~150 lines of C99

#187

Post by lelanthran »

This is quite neat. I wrote a similar library for no-alloc JSON parsing, but never had use for it. This does actual parsing, though; my approach is to just navigate through a JSON tree.

https://github.com/lelanthran/libxcgi/blob/master/library/sr...

https://github.com/lelanthran/libxcgi/blob/master/library/sr...

Re: Sj.h: A tiny little JSON parsing library in ~150 lines of C99

#188

Post by rurban »

olivia-banks wrote: post #154
lioeters wrote: post #8

What I love about this author's work is that they're usually single-file libraries in ANSI C or Lua with focused scope, easy-to-use interface, and good documentation. And free software license. Aside from the posted project, some I like are: - log.c - A simple logging library implemented in C99 - microui - A tiny immediate-mode UI library - fe - A tiny, embeddable language implemented in ANSI C - microtar - A lightwe…

I vendor in log.c all the time for C projects! I had no idea the author was relatively prolific. Would really recommend checking out log.c, it's really easy to hack in what you need to.

Ah, there is where we have log.c from. Good to know because I have plenty of tiny fixes for him.

Re: Sj.h: A tiny little JSON parsing library in ~150 lines of C99

#189

Post by zwnow »

Yeask wrote: post #163
zwnow wrote: post #45

Earlier quoted context omitted.

So if its a hobby project designed for just a handful of people, its suddenly okay to endanger them due to being sloppy?

Open Source is about sharing knowledge. They are sharing their knowledge about how to create a tiny JSON parser. Where is the problem again?

Refer to the original comment. Seems like you are incapable of connecting the comment chain.
Post reply on HN