On Sat, Sep 1, 2018 at 11:53 AM Graham Leggett <minf...@sharp.fm> wrote:
> On 31 Aug 2018, at 19:56, yla...@apache.org wrote:
> Author: ylavic
> Date: Fri Aug 31 17:56:40 2018
> New Revision: 1839779
> URL: http://svn.apache.org/viewvc?rev=1839779&view=rev
> Log:
> apr_json: follow up to r1839755: preserve formatting when decoding object 
> valueT
> The object key-value pair parsed by the JSON decoder contained pre/post spaces
> which we lost by changing the key type (to a C string) in 
> apr_json_object_set().
> Add a new/private apr__json_object_set() helper taking an apr_json_value_t key
> and use it in both apr_json_object_set() and apr_json_decode_object().
> Looking at 1839779 and 1839755, both of these need to be reverted as they 
> break RFC compliance with respect to the JSON RFC and JOSE RFCs (I’m -1 on 
> these changes).

There is probably another solution, see below.

> Please can you discuss these changes first before making them, I’ve had my 
> head buried in these RFCs for the past while and I can explain the design 
> choices behind the API, and add any documentation that’s lacking to clarify 
> how this works.

OK, sorry about this.

> JSON whitespace is significant in some RFCs, specifically the JWE and JWS 
> RFCs, and there needs to be a mechanism to formally support whitespace for 
> this API to be be useful in a security sensitive environment.

My changes were meant to allow simple (default) apr_json_object_set
without having to create a json_string for the key.
That's IMO how most users want it to be:
    apr_json_object_set(json, "somekey", apr_json_<type>_create(...));
rather than:
    apr_json_object_set(json, apr_json_string_create("somekey"),

> I am currently blocked behind these changes, so I’m going to revert them for 
> now so that I can get the JOSE code in. We can discuss this in more detail 
> once that is done.

I suppose what you want from my changes is to make the private
apr__json_object_set available in the API and use it for apr_jose
(e.g. with a different name like apr_json_object_put or something like
I find apr_json_object_set with a plain C string key more friendly in
the usual case...


Reply via email to