On Sun, Sep 11, 2011 at 12:23 AM, Stephan Beal <[email protected]> wrote: > On Sun, Sep 11, 2011 at 4:19 AM, Clark Christensen <[email protected]> > wrote: >> In my experience writing both JSON web services (in Perl), and the >> consumers of those services, sometimes you can get output that contains not >> only a JSON string, but stray newlines or other (debugging?) output. I'm >> sure you and Fossil would never do such a thing, right? Then again, >> anything's possible (useful debugging output, ISP-modified content, etc.) >> >> found that surrounding the JSON string with a predefined tag (I've >> standardized on <TJSON></TJSON>; because my company's name starts with "T", >> but Text-JSON works, too) makes it easy to extract the JSON string from >> whatever else might be in the response content. > > But it also makes it invalid JSON. :-?
Both yes and no. Clark is talking about encapsulating the JSON to protect it from problems introduced by "outside factors". In my own experience with my personal website, I have found that some service providers (not my web hosting provider, but ISPs between the web host and the browser), inject their own content into anything that looks like text regardless of the file extension or MIME type. One possible work-around to this is to always use HTTPS, however my hosting provider charges extra for this due to the extra CPU load required. Though a Fossil server hosted on your own hardware could do this without incuring a surcharge. The solution I use is similar to Clark's. I wrap otherwise plain text content in HTML to give these injectors a place to put their junk. Otherwise, they inject where ever they "think" is a good place , which makes a mess. (This is for coontent intended to be viewable in the browser; for downloadable content, I put that in ZIP files.) So yes, the full response from the server is not pure JSON, however, the pure JSON can be extracted from between the tags that contain it. While this does add a step before the JSON can be parsed, it does reduce the risk that the JSON content is tainted. While the HTTPS work-around is certainly preferable, not everyone has the luxury of this option. _______________________________________________ fossil-users mailing list [email protected] http://lists.fossil-scm.org:8080/cgi-bin/mailman/listinfo/fossil-users
