Consider replacing org.json because of license

[flkue]

Description

The org.json library runs under the JSON license which contains the part
"The Software shall be used for Good, not Evil."

This part leads to the problem, that the software is no longer free.

Links:
https://wiki.debian.org/qa.debian.org/jsonevil
https://www.apache.org/legal/resolved.html#json
https://dzone.com/articles/jsonorg-license-literally-says
https://www.gnu.org/licenses/license-list.html#JSON

To avoid this problem, use an alternative json library.

[rhuss]

Agreed, that we move away from org.json. Happy for any pull request. I tried to use

        <dependency>
            <groupId>com.vaadin.external.google</groupId>
            <artifactId>android-json</artifactId>
            <version>0.0.20131108.vaadin1</version>
        </dependency>

but failed because we need a JsonTokener which supports stream. We might consider to move to json-simple or any other json JSON library which supports parsing JSON tokens from a stream.

[rdifrango]

@rhuss I just submitted a PR to resolve this and I think I found a work-around for the fact that JsonTokener is missing.

[rhuss]

Thanks a lot ! I've seen the workaround but this is not really suitable as it will first consume the whole stream and then creates the tokenizer while the whole handler thing is that the tokens are consumer while they are coming in.

I'm still looking for an alternative and I think that https://github.com/fangyidong/json-simple/blob/master/src/main/java/org/json/simple/parser/JSONParser.java#L91 can do this as it will only consume the next JSON element in the stream and then returns. As json-simple is a complete independent JSON library we should be on the safe side, too.

I can give a try when I find some spare time ...