cl-json-devel

Download

cl-json-devel@common-lisp.net

June 2009

4 participants
2 discussions

[cl-json-devel] Not interning object keys
by Red Daly 10 Aug '09

10 Aug '09

Hello all, CL-JSON does not allow the user to customize the means used to decode the keys for object literals. It may be important to avoid interning in a web setting, for example, since interns of many unique symbols could potentially use a lot of memory. An attack could exploit this by submitting something that is passed through cl-json that has many very large, unique symbols. There used to be a way to get around this with the factory method customization, but the current library does not include a means of changing the decoding behavior for a key to avoid interning it. Unless I am missing something, could this functionality be added? Red

3 6

[cl-json-devel] (encode-json-to-string "</div>") => "\"<\\/div>\"" ?
by Leslie P. Polzer 17 Jun '09

17 Jun '09

Where do those two extra backslashes in front of the slash come from? Is this intended? Thanks, Leslie -- http://www.linkedin.com/in/polzer

3 3