Re: [Json] Proposed minimal change for duplicate names in objects

[Nico Williams <[e-mail]>]

On Sun, Jul 7, 2013 at 12:44 AM, Jim Schaad <[e-mail]> wrote:
> To be perfectly honest,  I would personally argue that this is a
> requirement that parsers need to enforce.  The JOSE group is going to
> need some interesting text about what happens if it is using a parser
> that does not enforce this mechanism.  And an even more interesting

JOSE was going to need that anyways.  If we manage to reach the
consensus you want then JOSE won't need to, but will JOSE wait for
JSON?

> question of how this would ever be determined if the parser is not
> part of the application itself.  That is how does a JOSE application
> know that the built in (assuming there is one) parser for the FOO
> language/environment it is operating in will correctly do the
> detection for it and not use the rule of grab the last value.

I'd say... "read the docs" and "test the parser" :)

(you'd have to no matter what; what if you got a YAML-based parser
that had remote code execution vulnerabilities?  surely you'd want to
avoid that...)

> I would also be open to the argument that a streaming parser is not
> really an entire parser and the thing that consumes the output of a
> streaming parser could be the entity that enforces the uniqueness
> requirement.

Right, that was my proposal.  There's little appetite for describing
parser types in the RFC though.

I'm ambivalent, but willing to go with requiring rejection of objects
with dup names.

Nico
--