Option for stringification of objects

[Grinnz]

Based on the behavior of Mojo::JSON and some discussion on dealing with references there, this is a suggestion for an option to stringify blessed references instead of encoding to null or throwing an exception, when no TO_JSON method is found. Perhaps stringify all objects such as Mojo::JSON does currently (better for debugging), or another possibility is to detect if the object has overload defined. Either way would make Cpanel::JSON::XS compatible with Mojo::JSON for structures which contain e.g. Mojo::ByteStream objects, or DateTime objects.

[rurban]

I agree. I've tried both variants back and forth, and there needs to be an option.

[kraih]

👍 I would really like to use that option.

[rurban]

The counter argument is explained here: https://www.youtube.com/watch?v=Gzx6KlqiIZE&feature=youtu.be

serializers who allow deserialization of objects, and JSON and Data::MessagePack are the only ones currently who do not, are unsafe.
our security team has lot of troubles with those serializers.

[Grinnz]

This feature does not allow for deserialization of objects, it is only an additional way to serialize them; when deserialized, they will still always be strings.

[mrenvoize]

Seems like a nice to have :)

[nnutter]

👍 Being able to fallback on stringification of an object for serialization would be more useful than just getting null. Could do something like convert_blessed([qw(TO_JSON to_string)]) or make another option like stringify_blessed(1) that just did $obj . ''.

[zoffixznet]

👍

[rurban]

Can somebody come up with a testcase please?
The true and false values would be \1 and \0, the Mojo::JSON docs are wrong there.

This test works ok:

use Test::More;
BEGIN {
  eval "require Mojo::JSON;";
  if ($@) {
    plan skip_all => "Mojo::JSON required for testing interop";
    exit 0;
  } else {
    plan tests => 6;
  }
}

use Mojo::JSON ();
use Cpanel::JSON::XS ();

my $booltrue = q({"is_true":true});
my $boolfalse = q({"is_false":false});
#my $boolpl     = { is_false => \0, is_true => \1 };
my $js = Mojo::JSON::decode_json( $booltrue );
is( $js->{is_true}, 1 );

my $cjson = Cpanel::JSON::XS->new;
is($cjson->encode( $js ), $booltrue)
  or diag "\$Mojolicious::VERSION=$Mojolicious::VERSION,".
  " \$Cpanel::JSON::XS::VERSION=$Cpanel::JSON::XS::VERSION";

$js = Mojo::JSON::decode_json( $boolfalse );
is( $cjson->encode( $js ), $boolfalse );
is( $js->{is_false}, 0 );

$js = $cjson->decode( $booltrue );
is( $cjson->encode( $js ), $booltrue ) or diag(ref $js->{is_true} );
$js = $cjson->decode( $boolfalse );
is( $cjson->encode( $js ), $boolfalse ) or diag(ref $js->{is_false} );

[Grinnz]

This issue is regarding stringification of objects, booleans are not a problem (anymore).

[rurban]

So we'll add the option stringify_blessed, which does the stringify overload on encode, but not on decode for security reasons. What else?

[Grinnz]

Here's a basic test case:

use Test::More;
use Cpanel::JSON::XS ();
use Time::Piece;

my $json = Cpanel::JSON::XS->new->allow_blessed(1);
# $json->stringify_blessed(1); ??? possible option

my $time = localtime;
my $encoded = $json->encode({time => $time});
my $decoded = $json->decode($encoded);
is($decoded->{time}, "$time", 'Time::Piece object was stringified') or diag($encoded);

done_testing;

EDIT: changed to explicit stringification test

[rurban]

See branch stringify_blessed-gh37 WIP

[rurban]

I couldn't get the AMAGIC call yet working, so I'll postpone this feature.

[rurban]

I'll keep the name convert_blessed for this feature. No need for an extra stringify_blessed.
See the branch convert_blessed-gh37

[zoffixznet]

👍

[rurban]

The feature works now >5.8.
The only question remaining is if to always embed the overloaded stringification into ""?
e.g.

$json->encode( { time => localtime } ) eq '{"time":"Thu Nov 26 11:15:16 2015"})

or

=> '{"time":Thu Nov 26 11:15:16 2015}'

Without embedded doubel-quotes it would allow to stringify into native js primitives, which might be a wanted feature.
like '{"time": { someother_object: 1} }', but then you should really use the TO_JSON method.

So I enforce "" now. It makes it easier to use normal default perl stringifications.

[kraih]

Agreed, enforcing "" seems much better. Anyone who wants to generate something else than a JSON string can just use TO_JSON.

[rurban]

All tests pass, I'll merge it now to master

[Grinnz]

EDIT: Moved to new issue #46