Just to roughly endorse this approach; in one of our applications we already had an in-house JSON parsing/writing API, which isn’t going to be very feature complete but majors in being very fast and efficient and meets the use-cases we’ve hit so far. My first instinct in integrating Groovy was to say, no, we must use JSONSlurper and JSONBuilder! but it was just… less convenient. And ultimately the parts of a JSON object implement Map or List, so it all works quite nicely in Groovy, and all I really needed to do was to add some type coercions, entirely in an extension module, so you can coerce a Map to a JSONObject, and coerce a JSONObject to a Writable, and … I was going to say “and so on” but honestly I think that was it.
(And in passing, it would keep json arrays in order, but not keys in json objects, because it’s backed by HashMap. And… this has never been a problem - because of course, our expectations were in line with this.) Rachel > On 11 Jul 2022, at 21:36, Guillaume Laforge <glafo...@gmail.com> wrote: > > A couple other notes here, is that... > > 1) Groovy, with its modules, doesn't intend to replace the kitchen-sinks of > the categories (Groovy JSON won't do more than Jackson), and tries to stick > to the smallest useful feature-set that will make Groovy developers > productive, > > 2) and regarding the sorting issue which happens only on some specific old > versions of the JDK that barely anyone uses nowadays, we should remember that > the JSON specification explicitly says that keys in JSON objects are not > ordered, so you should not assume they are (it would be a mistake, even if it > can be handy that they are) > > Guillaume > > On Mon, Jul 11, 2022 at 10:31 PM MG <mg...@arscreat.com > <mailto:mg...@arscreat.com>> wrote: > Hi Paul, > > thanks for clearing that up :-) > > (I did not refer to this evident water-under-the-bridge problem (which I > had never heard of before) in my post, but just wanted to confirm that > Groovy plays very well with & can easily be used to enhance established > Java frameworks, and people therefore should not feel the need to use > functionality that comes bundled with Groovy, if they are familiar with > or prefer another framework G-) ) > > Cheers, > mg > > > On 11/07/2022 05:15, Paul King wrote: > > On Mon, Jul 11, 2022 at 3:00 AM Guillaume Laforge <glafo...@gmail.com > > <mailto:glafo...@gmail.com>> wrote: > >> Which bug ticket are we talking about? > >> (The ordering issue in lists) > > I am not sure there was ever any issue raised in the Groovy's Jira. > > Groovy's JsonSlurper is a port from project Boon. Here is the issue > > and fix from project Boon: > > > > https://github.com/boonproject/boon/issues/182 > > <https://github.com/boonproject/boon/issues/182> > > https://github.com/boonproject/boon/commit/fa4c64991609 > > <https://github.com/boonproject/boon/commit/fa4c64991609> > > > > Basically on JDK1.6 there is an inherent problem with LinkedHashMap > > where it can be the subject of a DoS hash collision attack. In the > > context of JsonSlurper, by using carefully crafted JSON payloads it is > > possible in rare circumstances to implement a DoS attack. It is fixed > > (wth a system property) on JDK1.7 and permanently fixed for JDK1.8 and > > above. The Boon project decided to forgo map ordering on vulnerable > > systems to eliminate the DoS problem. Groovy ported that change to > > JsonSlurper. A map is a name-to-value container. The "also preserves > > order" property can be thought of as a nice feature to have in > > particular circumstances. The thinking I presume when Boon changed the > > behavior was that security was more important than the "nice to have" > > feature. Users should move to a non-vulnerable JDK version if they > > want the nicer behavior. > > > > The summary is that unless folks are stuck on JDK1.6, this shouldn't > > affect them. > > > > Here is a nice explanation of the problem explained using cats: > > > > https://www.anchor.com.au/blog/2012/12/how-to-explain-hash-dos-to-your-parents-by-using-cats/ > > > > <https://www.anchor.com.au/blog/2012/12/how-to-explain-hash-dos-to-your-parents-by-using-cats/> > > > > > > Cheers, Paul. > > > >> Le dim. 10 juil. 2022, 18:49, MG <mg...@arscreat.com > >> <mailto:mg...@arscreat.com>> a écrit : > >>> Hi Tommy, > >>> > >>> I agree: We have often found that using well established Java libraries > >>> together with the power of the Groovy language works well & makes great > >>> sense (e.g. Ebean ORM & Vaadin web-GUI in our case). > >>> Groovy's integrated support (for e.g. XML/JSON) is often very dynamic in > >>> nature, something which we often neither need nor want, and the small > >>> overhead of writing a thin, type/schema-safe wrapper around e.g. a > >>> generic Java XML SAX/DOM lib for a specific application case has always > >>> turned out to be well invested & makes the code better readable and > >>> easier to refactor. > >>> > >>> In addition these Java libs have often been debugged and performance > >>> optimized over the years in a way that Groovy finds hard to match, since > >>> it would spread its development manpower very thin. > >>> The command-line parsing library coming with Groovy nowadays is a good > >>> example of an imho better suited hybrid approach: It supplies Groovy > >>> goodness over an excellent existing Java library (picocli) G-) > >>> > >>> Cheers, > >>> mg > >>> > >>> > >>> > >>> On 10/07/2022 18:03, Tommy Svensson wrote: > >>> > >>> Hi Paul, > >>> > >>> Thanks, but after the warning that JSONSlurper can loose order in lists, > >>> a known bug, I decided to go with Jackson Jr, which also allows me to > >>> parse JSON into a Map structure. But since I'm coding entirely in Groovy > >>> using Groovys JSON support would make sense, but the pointed out bug > >>> scared me away :-). I have used Jackson Jr before, it works well. > >>> > >>> /Tommy > >>> > >>> > >>> Från: Paul King <pa...@asert.com.au <mailto:pa...@asert.com.au>> > >>> Svara: users@groovy.apache.org <mailto:users@groovy.apache.org> > >>> <users@groovy.apache.org <mailto:users@groovy.apache.org>>, > >>> pa...@asert.com.au <mailto:pa...@asert.com.au> <pa...@asert.com.au > >>> <mailto:pa...@asert.com.au>> > >>> Datum: 10 juli 2022 at 16:20:43 > >>> Till: users@groovy.apache.org <mailto:users@groovy.apache.org> > >>> <users@groovy.apache.org <mailto:users@groovy.apache.org>> > >>> Ämne: Re: Using Groovy 4.0.1 and want to use Groovys JsonSlurper or > >>> whatever it might be called in version 4. > >>> > >>> Hi Tommy, > >>> > >>> I wrote a little blog post that might have some of the information you > >>> were missing: > >>> > >>> https://blogs.apache.org/groovy/entry/parsing-json-with-groovy > >>> <https://blogs.apache.org/groovy/entry/parsing-json-with-groovy> > >>> > >>> Perhaps some more of that info belongs in the official documentation. > >>> > >>> Cheers, Paul. > >>> > >>> On Fri, Jul 8, 2022 at 9:10 PM Tommy Svensson <to...@natusoft.se > >>> <mailto:to...@natusoft.se>> wrote: > >>>> Hello Groovy people, > >>>> > >>>> I have code using org.apache.groovy:groovy:4.0.1 and it builds without > >>>> any problems. > >>>> > >>>> But now I want to use the JSONSlurper and it looks like there is a new > >>>> JSONParser also. That however requires groovy-all from googling. The > >>>> problem is that there seem to be not groovy-all for version 4.0.1. Maven > >>>> completely fails when I add "-all" to "groovy" in my poms. It will not > >>>> download the groovy-all file. I deleted ~/.m2/repository and built again > >>>> and it downloaded all but groovy-all. > >>>> > >>>> The JSON stuff is not available in the "groovy" artifact. > >>>> > >>>> So my question really is, I want to use Groovys JSON features, what do I > >>>> need to do to accomplish that ? > >>>> > >>>> I've completely failed top find any Groovy 4.0 related page other than > >>>> the release notes. Since there are big diffs between versions there must > >>>> be some page for each version I assume ? > >>>> > >>>> I found this: https://groovy-lang.org/processing-json.html > >>>> <https://groovy-lang.org/processing-json.html> but it is not version > >>>> specific and provides no information on how to get access to it. > >>>> > >>>> I'm frustrated. Something seemingly simple turned out to be the opposite! > >>>> > >>>> Any help is appreciated. > >>>> > >>>> Thanks, > >>>> Tommy Svensson > >>>> > >>>> > >>>> > >>> > > > > -- > Guillaume Laforge > Apache Groovy committer > Developer Advocate @ Google Cloud Platform > > Blog: http://glaforge.appspot.com/ <http://glaforge.appspot.com/> > Twitter: @glaforge <http://twitter.com/glaforge>
