Re: [Json] The names within an object SHOULD be unique.

[Stephen Dolan <[e-mail]>]

On Jun 7, 2013, at 5:22 AM, Stefan Drees ... wrote:
>
> Which b.t.w. I would certainly rewrite as:
>
> NEW
> """
> Generators SHOULD NOT duplicate names in objects. Parsers MUST be
> prepared to either accept duplicate names in objects or reject the
> complete JSON text containing these, as a generator might not avoid nor
> detect such duplication.
> """

Regarding duplicate keys, the issue was raised before that having
multiple valid interpretations of an input leads to security problems.
Consider this document:

    {"command": "no-op", "user": "untrustworthy-person", "command":
"launch-missiles"}

if submitted to a system which separates authorization from execution,
where both use JSON implementations which differ in their
interpretation of duplicate keys, this could end badly.

There are some JSON implementations which preserve duplicate keys, and
many which don't. However, I know of no implementation which
interprets {"a":2, "a":1} as {"a":2} - the implementations I've seen
keep either all or just the last entry. Codifying this behaviour in
the RFC would help to prevent the security issue described above, so
how about some text along the lines of:

    If an object contains several key-value entries with the same key,
a JSON parser MAY ignore all but the last of these entries. A JSON
parser MUST NOT ignore the last such entry.


Stephen Dolan