Import

[nilesuan]

Because JSON5 can bloat very easily, it would be great if we can import other json5 files into the main one and merge all the data together. Hence configuration of a stack can be modular and not one big chunk of json file.

[jordanbtucker]

Sorry for taking so long to reply to this, but I have been thinking about it. At first glance, this seems like a really nice feature, but I do have some concerns.

• Syntax
  • import is ES6, so for JSON5 to be backward compatible with ES5, perhaps an import() syntax could be used.
• Merges
  • What happens when a.json5 imports b.json5 but both define an object with a property c? Who wins?
  • What happens when a.json5 imports b.json5 at its root but a.json5 defines an object while b.json5 is an array?
• Path Resolution
  • Does import('a.json5') import a file in the same folder as the current file, or in the current working directory, or any a.json5 file up the hierarchy?
  • If root.json5 imports subdir/a.json5 and a.json5 imports b.json5, where does JSON5 look for b.json5? In subdir or in the same folder as root.json5?
  • What does import('/a.json5') do?
  • Is this okay? import('../../../../../../../../../../a.json5')
  • What if a JSON5 document is being loaded in the browser?
• Security
  • Can a JSON5 document import arbitrary paths like in /usr/lib?
  • What if a JSON5 document attempts to import the same path many times in an attempt to cause a DoS?
• Cyclic Imports
  • What if a.json5 imports b.json5 and b.json5 imports a.json5?
  • What if a.json5 imports itself?

There are probably many more concerns that I can't think of yet.

I'm not saying we shouldn't implement this feature. But as you can see, there is a lot to discuss first.

[mindplay-dk]

My first concern would be, how would this even work when the document is being fetched from a web-server? Or worse, over web-sockets, where there isn't even any concept of paths?

In my opinion, this feature would be quite a radical departure from JSON, being a self-contained data file format - and over an HTTP connection, it would likely raise all sorts of questions about caching and security as well. These aren't simple problems.

I think this is more complexity than a JSON-successor should take on?