sonnyp / json8 Goto Github PK

I'm trying to use a replacer function in order to remove properties with an undefined value. However, the object to serialize also contains new Map/Set structures, which aren't properly serialized if the replacer simply returns the value:

> oo.serialize({foo: 'bar', baz: undefined, qux: new Map([['a', 1]])}, {replacer: (k,v) => v})
'{"foo":"bar","qux":{}}'

I've tried to have the replacer return oo(v) or even oo.serialize(v) but the former doesn't work, and the latter complains about undefined values.

http://tools.ietf.org/html/rfc6902 leads to HTTP 404 Not Found.
Perhaps update to http://tools.ietf.org/html/rfc6902 ?

The json8-pointer package doesn't export walk method,

Hi. I want to use diff on potentially large objects that are mainly shallow copies of each other but with some parts changed (what happens when you apply patches immutably).

To get a sense of if this library would perform well in this case, I went looking to see if there was an early return when parts were === identical.

I found https://github.com/sonnyp/JSON8/blob/master/packages/patch/lib/diff.js#L27 which seems like an early return in that case, so that's good, but given that, I was wondering if it could have returned even earlier? Like perhaps at line 11?

Installing just json8-merge-patch fails with error at this line:
https://github.com/sonnyp/JSON8/blob/master/packages/merge-patch/lib/toJSONPatch.js#L4

Hi, currently the pointer package only exposes post-iteration dicts/index - it would be nice if the walk function an iterator/generator interface was exposed, e.g.,

for (const [ptr, val] of pointer.entries(myPointer))
  ...

Maybe entries, flatEntries, primitives, or something like that, to select what to iterate over.

This comes from the fact that JSON8 errors when serializeing Symbols. Even if these aren’t serializable in the technical sense, there’s value in displaying, for humans, that a particular value is a Symbol.

Thanks for considering!

https://github.com/sonnyp/JSON8/blob/master/packages/merge-patch/lib/apply.js#L18
because of this line, nested objects will not have usual Object.prototype.methods in the prototype chain and fails at this line https://github.com/sonnyp/JSON8/blob/monorepo/packages/merge-patch/lib/diff.js#L20

May I ask how I can use these modules installed from npm such that they are not failing at hidden tight couplings of datatypes? :)

So I've been trying to use the serializer on node to serialize around 1500 elements in a Map, but for some reason serializer hangs, it works fine for smaller maps though.

The map contains user objects from github API (e.g https://developer.github.com/v3/repos/#list-contributors).

Are there any known bugs around that? Let me know if you need any debug details from me.

Prototype pollution vulnerability in function add() in json8-patch/lib/add.js in json8-patch1.0.6 via the function add and variable add
The function usevariable partent and function add lead to Prototype pollution in line 43

I noticed that json8-patch seems to be quite fast, with the exception of arrays. Consider the following:

var obj = {
    "x": "SomeVal",
    "y": [{ "z": 2}, {"z": 3}, {"z": 4}, {"z": 5}]
}

var obj2 = {
    "x": "SomeVal",
    "y": [{ "z": 2}, {"z": 6}, {"z": 4}, {"z": 5}]
}

I would expect this to return a patch of:

[
  {
    "op": "replace",
    "path": "/y/1/z",
    "value": 6
  }
]

Instead, it returns:

[
  {
    "op": "replace",
    "path": "/y",
    "value": [
      {
        "z": 2
      },
      {
        "z": 6
      },
      {
        "z": 4
      },
      {
        "z": 5
      }
    ]
  }
]

Are they any plans for supporting objects within arrays without replacing the entire array?

hi,

serializing a map with numeric keys does not work and ends in something like

TypeError: 21 key is not a string

import * as oo from 'json8';

const v = new Map();
v.set(4,5);

oo.serialize(v);
``

You might want a fix like this, or maybe this for this problem...

just tried it out an a 22mb json file, and compared a couple of libraries:

json8-patch: 90ms
jiff: 960ms (ie: > 10 slower)
fast-json-patch: failed, couldn't parse the document
impressive !

Can't install text-sequence and merge-patch-to-patch from NPM registry:

npm install text-sequence merge-patch-to-patch 

Look like these packages are missed.

Here's a simple usage of a replacer function that aims to remove properties with an undefined value:

> s = oo.serialize({foo: 'bar', baz: undefined}, {replacer: (k,v) => v})
'{"foo":"bar",}'

> JSON.parse(s)
SyntaxError: Unexpected token }
    at Object.parse (native)

If the property removed is the last in the object, then the serialization leaves an extra comma.

Prototype Pollution:
This package fails to restrict access to prototypes of objects, allowing for modification of prototype behavior, which may allow obtaining sensitive information/DoS/RCE.

If required I can submit a POC through a secured channel. Thanks.

take this input :

[{"nom":"joe","age":26},{"age":30,"nom":"arnaud"},{"age":26,"nom":"émilie"}]

apply this patch :

[{"op":"remove","path":"/1"},{"op":"move","from":"/0/age","path":"/1/age"},{"op":"add","path":"/-","value":"essai"}]

the revert patch produced by buildRevertPatch do not revert data.
In fact, move operation overwrite an existing value and revert fail to restore it.

iterators pass the value as first argument and key as second

https://github.com/Starcounter-Jack/JSON-Patch#jsonpatchgeneratedocument-any-observer-observer-invertible--false-operation