Parsing JSON Is a Minefield (2016)
Some other fun facts about JSON, its mainstream implementations and using it reliably:<p>1. json.dump(s) in Python by default emits non-standards-compliant JSON, ie. will happily serialize NaN&#x2F;Inf&#x2F;-Inf. You want to set allow_nan=False to be compliant. Otherwise this _will_ annoy someone who has to consume your shoddy pseudo-JSON from a standards-compliant library.<p>2. JSON allows for duplicate&#x2F;repeated keys, and allows for the parser to basically do anything when that happens. Do you know how the parser implementation you use handles this? Are you sure there&#x27;s no differences between that implementation and other implementations used in your system (eg. between execution and validation)? What about other undefined behaviour, like permitted number ranges?<p>3. Do you pass around user-provided JSON data accross your system? How many JSON nesting levels does your implementation allow? What happens if it&#x27;s exceeded? What happens if different parts of your processing system have different limits? What about other unspecified limits like serialized size, string length?<p>My general opinion is that it&#x27;s extremely hard to reliably use JSON as an interchange format reliably when multiple systems and&#x2F;or parser implementations are involved. It&#x27;s based on a set of underdefined specifications that leaves critical behaviour undefined, effectively making it impossible to have 100% interoperable implementations. It doesn&#x27;t help that one of the mainstream implementations (in Python) is just non-compliant by default.<p>I highly encourage any greenfield project to look into well designed and better specified alternatives.