Safe JSON parsing in GWT?

Question

Hi,

How do we do safe JSON parsing with GWT? It looks like the json parser GWT offers uses eval() - is there a different option which uses the native implementations when available?

Thanks

------------- Edit ----------------------------

Ok I got a script from here:

http://code.google.com/p/json-sans-eval/

which is supposed to not use eval (so should be safe I hope!), and use it like this:

private native JavaScriptObject nativeParseUntrustedJson(String jsonString) /*-{ 
    return $wnd.jsonParse(jsonString);    
}-*/; 

it works, does that look ok?

Thanks!!

Answer 1

I don't know of any built-in GWT way to parse JSON without reverting to eval, but you can try using your favorite parser via JSNI then returning a JavaScriptObject to pass into the constructor to a JSONObject, e.g.

native JavaScriptObject native_parse(String json_data) /*-{
  return $wnd.JSON.parse(json_data);    
}-*/;

where JSON.parse can refer to http://www.json.org/json2.js, e.g. via the following HTML:

<script src="json2.js"></script>

Then try creating a JSONObject via:

new JSONObject(native_parse(json_data));