per the debate in this post: json-conversion-in-javascript
+2
A:
Per the JSON RFC, an array is indeed legal top-level JSON-text: "A JSON text is a serialized object or array."
Dustin Getz
2010-09-30 17:44:06
A:
Yes.
Is there really a need to debate this? Any JS data structure is valid JSON.
Sorpigal
2010-09-30 17:45:03
Not exactly true. functions are data types in javascript, yet they are not allowed by the JSON spec.
David
2010-09-30 17:50:25
This is wrong. JSON is a quite limited subset of JavaScript.
Matthew Flaschen
2010-09-30 17:52:45
I knew someone would quibble about functions. It's true.
Sorpigal
2010-09-30 17:58:41
@Sorpigal, that's not the only exception. You can't directly represent dates or regex literals either. So "any" is definitely wrong.
Matthew Flaschen
2010-09-30 18:02:11
{a='b'} fails twice--must quote the name, and must use double quotes. this is actually relevant because boost's JSON-parsing functionality fails to parse both of these cases.
Dustin Getz
2010-09-30 21:41:12
A:
This is from the ECMAScript specification.
JSONText :
JSONValue
JSONValue :
JSONNullLiteral
JSONBooleanLiteral
JSONObject
JSONArray
JSONString
JSONNumber
ChaosPandion
2010-09-30 17:45:18
This is a little misleading, though, because ECMAScript allows you to parse JSON strings that are not top-level texts. According to the RFC, "A JSON text is a serialized object or array."
Matthew Flaschen
2010-09-30 17:55:30
@Matthew - Weird, I wonder how Crockford feels about that. How will they reconcile the differences between the RFC and ECMA?
ChaosPandion
2010-09-30 17:59:30
@Chaos, I just looked, and found they're aware of the difference. From ECMAScript 5 §15.12, "The top level JSONText production of the ECMAScript JSON grammar may consist of any JSONValue rather than being restricted to being a JSONObject or a JSONArray as specified by RFC 4627." I don't know if IETF will change the RFC.
Matthew Flaschen
2010-09-30 18:06:27
+1
A:
Yes, but you should consider making the root an object instead in some scenarios, due to JSON hijacking. This is an information disclosure vulnerability based on overriding the array constructor in JavaScript.
Matthew Flaschen
2010-09-30 17:56:50