On Thu, Jun 25, 2009 at 1:29 PM, Boris Smilga <boris.smilga@gmail.com> wrote:

On 25 Jun 2009, at 22:27, Red Daly wrote:

CL-JSON does not allow the user to customize the means used to decode the keys for object literals. It may be important to avoid interning in a web setting, for example, since interns of many unique symbols could potentially use a lot of memory. An attack could exploit this by submitting something that is passed through cl-json that has many very large, unique symbols.

Indeed, thank you for pointing this out.

There used to be a way to get around this with the factory method customization, but the current library does not include a means of changing the decoding behavior for a key to avoid interning it. [...]

It is the same thing in the new version, except that customization works in a somewhat different way. Broadly speaking, you have to redefine the way a level of JSON Object structure is accumulated to form the corresponding Lisp structure. E. g., in the following example new (KEY . VALUE) pairs are clipped onto the end of a list accumulator, to form an alist:

(defvar *accumulator* nil)
(defvar *accumulator-last* nil)

(defun init-accumulator ()
(setq *accumulator* (cons nil nil)
*accumulator-last* *accumulator*))

(defun collect-key (key)
(setq *accumulator-last*
(setf (cdr *accumulator-last*)
(cons (cons key nil) nil))))

(defun collect-value (value)
(setf (cdar *accumulator-last*) value))

(defun accumulator-get-value ()
(cdr *accumulator*))

(json:bind-custom-vars
(:beginning-of-object #'init-accumulator
:object-key #'collect-key
:object-value #'collect-value
:end-of-object #'accumulator-get-value
:object-scope '(*accumulator* *accumulator-last*))
(json:decode-json-from-string
"{\"foo\": [{\"bar\": \"xyzzy\"}, {\"baz\": true}],
\"quux\": 123}"))

=> (("foo" (("bar" . "xyzzy")) (("baz" . T))) ("quux" . 123))

Thanks for an example of a custom accumulator modification. Just out of curiosity, have you seen the accumulator paradigm crop up in other contexts?

[...] Unless I am missing something, could this functionality be added?

No problem, but could you maybe provide a sample of phantasy code which showed how this kind of customization interface should look from the user's side? With that, we'll be more able to meet your expectations. (I cannot, of course, guarantee that your interface shall be reproduced 100% exactly, rather it'll serve as a guideline.)

It would be nice to have something like:

(let ((json:*json-symbolize-lisp-key* 'identity))
...)

This is still a little confusing unless you are familiar with the *json-identifier-name-to-lisp* variable, in which case it makes a little more sense.

Yours,
- B. Smilga.