Queries involving keys containing four backslashes ("\\\\") failing.

[jimblackler]

I encountered a problem with an application when JSON keys contained four backslashes (\\).

After a lot of debugging I found that JSONPointer (used in my app) was returning null when queried. Stepping through the code it seems that the token used for the key may be double unescaped; I saw the same token unescaped() on line 173 when the JSONPointer was built, then on line 213 when the pointer was used in a query.

https://github.com/stleary/JSON-java/blob/master/src/main/java/org/json/JSONPointer.java#L173
https://github.com/stleary/JSON-java/blob/master/src/main/java/org/json/JSONPointer.java#L213

This example test will fail on the trunk version of the library:

jimblackler@8d6e1d8#diff-b4df778ff5909ef85877e003ed15b3beR279

(Note there are eight double slashes in the literal in the test, because it's escaped for the Java string literal)

I'm not 100% sure of my understanding of the issue or the correct behavior. I'd be grateful if someone who is familiar with the practices handling these strings could comment or confirm, and also advise if the fix in the patch above is something that I should submit.

[johnjaylward]

@erosb do you have time to look at this one?

[jimblackler]

Thanks guys. I found that the pattern ~~0 fails for the same reason.

[stleary]

Will wait a few more days in case @erosb is available to look into this.

[erosb]

Guys, unfortunately I can't see any chance of looking into this in detail in the near future.

[stleary]

@erosb No worries, thanks for responding

[stleary]

Looks like this will need to be addressed without the benefit of expert advice.

It seems likely to me that the implementation is only intended to handle Java strings with quotes and double backslashes, both of which happen to be examples in RFC6901. Arbitrary sequences of backslashes in keys would appear to be unsupported. There may also be an issue with the code calling JSONPointer.unescape() twice in succession, from the JSONPointer() constructor, and again from queryFrom(). This does not seem correct. The escape() method on the other hand is only called from toString().

If anyone wants to see if they can address this without affecting existing functionality, they are welcome to go ahead.

[niteshbheda]

I am facing a similar issue in Values when we a backslash escape character supporting " inside the value then .op function fails to return the escape character. For instance:

package com.chu;

import org.json.JSONObject;
import org.json.XML;

public class Test {

public static void main(String[] args) {
    // TODO Auto-generated method stub

    String input = "{\"Parameters\":{\"PAYERS_NAME\":\"ТОВАРИСТВО З ОБМЕЖЕНОЮ ВІДПОВІДАЛЬНІСТЮ \\\"ЕКСПО-ЛІС\\\"\"}}";

    JSONObject json = new JSONObject(input);

    JSONObject jsonObj = ((JSONObject) json.get("Parameters"));
    System.out.println(jsonObj.get("PAYERS_NAME"));
    System.out.println(XML.toString(json, "root"));

}

}

Output

ТОВАРИСТВО З ОБМЕЖЕНОЮ ВІДПОВІДАЛЬНІСТЮ "ЕКСПО-ЛІС"
<PAYERS_NAME>ТОВАРИСТВО З ОБМЕЖЕНОЮ ВІДПОВІДАЛЬНІСТЮ "ЕКСПО-ЛІС"</PAYERS_NAME>

As you can see this is causing an issue in conversion.

[stleary]

Does anyone want to address this with a code fix?

[johnjaylward]

I'm booked up pretty solid through Feb with work. If someone else could get a PR, I should have time to review it though.

[johnjaylward]

I believe #588 will fix this as well

[johnjaylward]

@jimblackler comparing your changes to the changes in #588, I believe #588 is more correct. We still need to escape/unescape the / and ~ characters, so we still need the method to be called. Sorry it took us so long to review this and get a fix in.

[katldewitt]

Hi! I'm interested in working on this for a school project in October and November

[stleary]

Hi @katldewitt, feel free to work on this!

[johnjaylward]

This should already be fixed. This may only need explicit test cases

[katldewitt]

I just issued #640 to address this issue and clarify behavior. As @johnjaylward mentioned, #588 corrected the behavior already, so my PR is an explicit test case and a note about documentation.
Thanks in advance!

[stleary]

Issue resolved in #640