Re: [Json] "Generators SHOULD escape all Unicode whitespace characters"?

On Mon, Jun 10, 2013 at 11:54 PM, Jacob Davies <jacob@well.com> wrote:
> I'm curious if anyone else thinks this is worth suggesting to
> implementors. There are a number of non-ASCII Unicode whitespace and
> control characters that are not required to be escaped right now.
>
> I think generators SHOULD escape them. Obviously parsers must continue
> to accept them unescaped regardless. The set is fairly small and could
> be enumerated in the document (it might expand in future, but this
> would be a good start):
>
> http://en.wikipedia.org/wiki/Space_(punctuation)#Spaces_in_Unicode
>
> "Whitespace smuggling" is a mild security concern and, from
> experience, can be quite hard to debug if non-0x20 spaces are not
> escaped. There is a small overhead of a couple of characters in doing
> so.
>
> Everything else in JSON's text serialization uses either printing
> characters, insignificant ASCII whitespace between values, or plain
> spaces in strings. Of course some printing Unicode characters are
> doppelgängers so perhaps people feel it is not worth worrying about
> whitespace either.
> _______________________________________________
> json mailing list
> json@ietf.org
> https://www.ietf.org/mailman/listinfo/json

There is an interesting issue with unescaped unicode whitespace:
ECMAScript does not allow U+2028 LINE SEPARATOR inside a string
literal, yet JSON does (as it is not one of the listed
must-always-be-escaped characters).

See http://timelessrepo.com/json-isnt-a-javascript-subset

Stephen