Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:118502
Message-ID: <4e9741c0-a338-f9af-4d78-705db6bcf5b4@bastelstu.be>
Date: Fri, 26 Aug 2022 12:15:47 +0200
MIME-Version: 1.0
Content-Language: en-US
To: Hans Henrik Bergan <divinity76@gmail.com>,
 =?UTF-8?Q?Micha=c5=82_Marcin_Brzuchalski?= <michal.brzuchalski@gmail.com>
Cc: Dusk <dusk@woofle.net>, David Gebler <davidgebler@gmail.com>,
 juan carlos morales <dev.juan.morales@gmail.com>,
 PHP Internals List <internals@lists.php.net>
References: <CANMwmbN8_Km+urXbNO7oWvNteYA2mTPNYyRgfaoypEK1Cw4F0A@mail.gmail.com>
 <CA+p1FaZDm3-h_LoOwv619wFyPg+2pAM8qC2La438sU_SPHZnCg@mail.gmail.com>
 <CABdc3WqsDc+80ATdX9+qstOkf+eUYCAQNPeV_FXcHiFumVQb8A@mail.gmail.com>
 <8D53AD5B-7CFC-4820-9EE4-FEB365D327A8@woofle.net>
 <CABdc3Wo7_qJOtebvA2GNGFUGFAut3tJOShXDBLHnRKqhrwVJ-g@mail.gmail.com>
 <CAJmy8YF2wgF-X3OY1vXbqNLX9wiDTdn8ro3FH2ReOwcOkASk=Q@mail.gmail.com>
In-Reply-To: <CAJmy8YF2wgF-X3OY1vXbqNLX9wiDTdn8ro3FH2ReOwcOkASk=Q@mail.gmail.com>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 8bit
Subject: Re: [PHP-DEV] RFC json_validate() - status: Under Discussion
From: tim@bastelstu.be (=?UTF-8?Q?Tim_D=c3=bcsterhus?=)

Hi

On 8/26/22 11:14, Hans Henrik Bergan wrote:
>> you can't efficiently validate JSON in userland
> 
> Has anyone actually put that claim to the test? Has anyone actually made a
> userland json validator (not just wrap json_decode()/json_last_error()) for
> performance comparison?
> ( if not, https://www.json.org/JSON_checker/JSON_checker.c  would probably
> be a good start)
> 

Worded like "you can't efficiently" the claim is false. Of course you 
can memory-efficiently validate the input by traversing the string byte 
by byte and keeping track of the nesting.

However the points that make a userland implementation infeasible are:

1. Writing a JSON parser is non-trivial as evidenced by: 
https://github.com/nst/JSONTestSuite. I expect userland implementations 
to be subtly buggy in edge cases. The JSON parser in PHP 7.0+ is 
certainly more battle-tested and in fact it appears to pass all of the 
tests in the linked test suite.

2. Even if the userland implementation is written very carefully, it 
might behave differently than the native implementation used by 
json_decode() (e.g. because the latter is buggy for some reason or 
because the correct behavior is undefined). This would imply that an 
input string that was successfully validated by your userland parser 
might ultimately fail to parse when passed to json_decode(). This is 
exactly what you don't want to happen.

Best regards
Tim Düsterhus