search

ring-clojure / ring-json

Ring middleware for handling JSON
313 stars 47 forks source link

Cheshire lazy parsing lets some malformed JSON pass through #57

Open rwilson opened 6 years ago

rwilson commented 6 years ago

Specifically, when the malformed JSON is in an array.

It's easily demonstrated in a repl:

user> (def bad-json (cheshire.core/parse-string "[{\"foo\": 1 2}]"))
#'user/bad-json
user> (type bad-json)
clojure.lang.LazySeq
user> (first bad-json)
JsonParseException Unexpected character ('2' (code 50)): was expecting comma to separate Object entries
 at [Source: (StringReader); line: 1, column: 13]  com.fasterxml.jackson.core.JsonParser._constructError (JsonParser.java:1798)

The JsonParseException isn't thrown until the lazy sequence is realized, which may not be until subsequent middleware or an endpoint.

Options could be:

  1. Lazy parsing has some benefits, leave it and document for clarity.
  2. Always or optionally realize body to catch the exception

Thoughts?

dco-lentz commented 4 years ago

This was a puzzling behavior that i also had to track down. My opinion is that by default the library should not silently pass along invalid JSON until the lazy sequence is ultimately realized down the line, likely outside of whatever try/catch block one has put in place to handle decoding errors. Opt-in laziness would be better.