You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
@@ -11,8 +11,26 @@ You can find this code on [Maven Central](https://central.sonatype.com/artifact/
11
11
12
12
To kick the tyres on the New JSON API this repo uses to implement a JSON Schema Validator which is released on Maven Central as [java.util.json.schema](https://central.sonatype.com/artifact/io.github.simbo1905.json/java.util.json.schema).
13
13
14
+
We welcome contributes to the JSON Schema Validator incubating within this repo.
14
15
15
-
## Quick Start
16
+
## Usage Examples
17
+
18
+
## API Overview
19
+
20
+
The API provides immutable JSON value types:
21
+
-`JsonValue` - Base type for all JSON values
22
+
-`JsonObject` - JSON objects (key-value pairs)
23
+
-`JsonArray` - JSON arrays
24
+
-`JsonString` - JSON strings
25
+
-`JsonNumber` - JSON numbers
26
+
-`JsonBoolean` - JSON booleans (true/false)
27
+
-`JsonNull` - JSON null
28
+
29
+
Parsing is done via the `Json` class:
30
+
31
+
```java
32
+
JsonValue value =Json.parse(jsonString);
33
+
```
16
34
17
35
### Parsing JSON to Maps and Objects
18
36
@@ -28,7 +46,7 @@ int age = ((JsonNumber) obj.members().get("age")).intValue();
28
46
boolean active = ((JsonBoolean) obj.members().get("active")).value();
-**✅Enable early adoption**: Let developers try the unstable Java JSON patterns today on JDK 21+
62
-
-**✅API compatibility over performance**: Focus on matching the emerging "batteries included" API design rather than competing with existing JSON libraries on speed.
63
-
-**✅Track upstream API**: Match emerging API updates to be a potential "unofficial backport" if a final official solution ever lands.
64
-
-**✅Host Examples / Counter Examples**: Only if there is community interest.
65
-
66
-
## Non-Goals
67
-
68
-
-**🛑Performance competition**: This backport is not intended to be the fastest JSON library. The JDK internal annotations that boost performance had to be removed.
69
-
-**🛑Feature additions**: No features beyond what's in the experimental upstream branches. Contributions of example code or internal improvements are welcome.
70
-
-**🛑Production / API stability**: Its an unstable API. It is currently only for educational or experimenal usage.
71
-
-**🛑Advoocacy / Counter Advocacy**: This repo is not an endorsement of the proposed API nor a rejection of other solutions. Please only use the official Java email lists to debate the API or the general topic.
72
-
73
-
## Current Status
74
-
75
-
This code (as of 2025-09-04) is derived from the OpenJDK jdk-sandbox repository “json” branch at commit [a8e7de8b49e4e4178eb53c94ead2fa2846c30635](https://github.com/openjdk/jdk-sandbox/commit/a8e7de8b49e4e4178eb53c94ead2fa2846c30635) ("Produce path/col during path building", 2025-08-14 UTC).
76
-
77
-
The original proposal and design rationale can be found in the included PDF: [Towards a JSON API for the JDK.pdf](Towards%20a%20JSON%20API%20for%20the%20JDK.pdf)
78
-
79
-
### CI: Upstream API Tracking
80
-
- A daily workflow runs an API comparison against the OpenJDK sandbox and prints a JSON report. Implication: differences do not currently fail the build or auto‑open issues; check the workflow logs (or adjust the workflow to fail on diffs) if you need notifications.
81
-
82
-
## Modifications
83
-
84
-
This is a simplified backport with the following changes from the original:
85
-
- Replaced `StableValue.of()` with double-checked locking pattern.
86
-
- Removed `@ValueBased` annotations.
87
-
- Compatible with JDK 21.
88
-
89
-
## Security Considerations
90
-
91
-
**⚠️ This unstable API contains undocumented security vulnerabilities.** The compatibility test suite (documented below) includes crafted attack vectors that expose these issues:
92
-
93
-
-**Stack exhaustion attacks**: Deeply nested JSON structures can trigger `StackOverflowError`, potentially leaving applications in an undefined state and enabling denial-of-service attacks
94
-
-**API contract violations**: The `Json.parse()` method documentation only declares `JsonParseException` and `NullPointerException`, but malicious inputs can trigger undeclared exceptions
95
-
96
-
These vulnerabilities exist in the upstream OpenJDK sandbox implementation and are reported here for transparency.
97
-
98
-
## JSON Schema Validator
99
-
100
-
By including a basic schema validator that demonstrates how to build a realistic feature out of the core API. To demonstrate the power of the core API, it follows Data Oriented Programming principles: it parses JSON Schema into an immutable structure of records, then for validation it parses the JSON to the generic structure and uses the thread-safe parsed schema as the model to validate the JSON being checked.
101
-
102
-
A simple JSON Schema validator is included (module: json-java21-schema).
103
-
104
-
```java
105
-
var schema =io.github.simbo1905.json.schema.JsonSchema.compile(
Compatibility: runs the official 2020‑12 JSON Schema Test Suite on `verify`; **strict compatibility is 61.6%** (1024 of 1,663 validations). [Overall including all discovered tests: 56.2% (1024 of 1,822)].
116
-
117
-
### JSON Schema Test Suite Metrics
118
-
119
-
The validator now provides defensible compatibility statistics:
-**✅Enable early adoption**: Let developers try the unstable Java JSON patterns today on JDK 21+
253
+
-**✅API compatibility over performance**: Focus on matching the emerging "batteries included" API design rather than competing with existing JSON libraries on speed.
254
+
-**✅Track upstream API**: Match emerging API updates to be a potential "unofficial backport" if a final official solution ever lands.
255
+
-**✅Host Examples / Counter Examples**: Only if there is community interest.
353
256
354
-
The 2 failing cases involve duplicate object keys, which this implementation rejects (stricter than required by the JSON specification). This is an implementation choice that prioritizes data integrity over permissiveness.
257
+
## Non-Goals
355
258
356
-
### Understanding the Results
259
+
-**🛑Performance competition**: This backport is not intended to be the fastest JSON library. The JDK internal annotations that boost performance had to be removed.
260
+
-**🛑Feature additions**: No features beyond what's in the experimental upstream branches. Contributions of example code or internal improvements are welcome.
261
+
-**🛑Production / API stability**: Its an unstable API. It is currently only for educational or experimenal usage.
262
+
-**🛑Advoocacy / Counter Advocacy**: This repo is not an endorsement of the proposed API nor a rejection of other solutions. Please only use the official Java email lists to debate the API or the general topic.
263
+
264
+
## Current Status
265
+
266
+
This code (as of 2025-09-04) is derived from the OpenJDK jdk-sandbox repository “json” branch at commit [a8e7de8b49e4e4178eb53c94ead2fa2846c30635](https://github.com/openjdk/jdk-sandbox/commit/a8e7de8b49e4e4178eb53c94ead2fa2846c30635) ("Produce path/col during path building", 2025-08-14 UTC).
267
+
268
+
The original proposal and design rationale can be found in the included PDF: [Towards a JSON API for the JDK.pdf](Towards%20a%20JSON%20API%20for%20the%20JDK.pdf)
269
+
270
+
The JSON compatibitlity tests in this repo suggest 99% conformance with a leading test suite when in "strict" mode. The two conformance expecatations that fail assume that duplicated keys in a JSON document are okay. The upstream code at this time appear to take a strict stance that it should not siliently ignore duplicate keys in a json object.
271
+
272
+
### CI: Upstream API Tracking
273
+
274
+
A daily workflow runs an API comparison against the OpenJDK sandbox and prints a JSON report. Implication: differences do not currently fail the build or auto‑open issues; check the workflow logs (or adjust the workflow to fail on diffs) if you need notifications.
357
275
358
-
-**Files skipped**: Currently 0 files skipped due to robust encoding detection that handles various character encodings
359
-
-**StackOverflowError**: Security vulnerability exposed by malicious deeply nested structures - can leave applications in undefined state
360
-
-**Duplicate keys**: Implementation choice to reject for data integrity (2 files fail for this reason)
276
+
## Modifications
277
+
278
+
This is a simplified backport with the following changes from the original:
279
+
- Replaced `StableValue.of()` with double-checked locking pattern.
280
+
- Removed `@ValueBased` annotations.
281
+
- Compatible with JDK 21.
282
+
283
+
## Security Considerations
284
+
285
+
**⚠️ This unstable API historically contained a undocumented security vulnerabilities.** The compatibility test suite (documented below) includes crafted attack vectors that expose these issues:
286
+
287
+
-**Stack exhaustion attacks**: Deeply nested JSON structures can trigger `StackOverflowError`, potentially leaving applications in an undefined state and enabling denial-of-service attacks
288
+
-**API contract violations**: The `Json.parse()` method documentation only declares `JsonParseException` and `NullPointerException`, but malicious inputs can trigger undeclared exceptions
361
289
362
-
This tool reports status and is not a criticism of the expermeintal API which is not available for direct public use. This aligning with this project's goal of tracking upstream unstable development without advocacy. If you have opinions, good or bad, about anything you see here please use the official Java email lists to discuss. If you see a bug/mistake/improvement with this repo please raise an issue and ideally submit a PR.
290
+
Such vulnerabilities existed at one point in the upstream OpenJDK sandbox implementation and were reported here for transparency. Until the upstream code is stable it is probably better to assume that such issue or similar may be present or may reappear. If you are only going to use this library in small cli programs where the json is configuration you write then you will not parse objects nested to tens of thousands of levels designed crash a parser. Yet you should not at this tiome expose this parser to the internet where someone can choose to attack it in that manner.
291
+
292
+
## JSON Schema Validator
293
+
294
+
This repo contains an incubating schema validator that has the core JSON API as its only depenency. This sub project demonstrates how to build realistic JSON heavy logic using the API. It follows Data Oriented Programming principles: it compiles the JSON Schema into an immutable structure of records. For validation it parses the JSON document to the generic structure and uses the thread-safe parsed schema and a stack to visit and validate the parsed JSON.
295
+
296
+
A simple JSON Schema validator is included (module: json-java21-schema).
297
+
298
+
```java
299
+
var schema =io.github.simbo1905.json.schema.JsonSchema.compile(
Please see AGENTS.md for more guidence such as how to enabled logging when running the JSON Schema Validator.
334
+
335
+
## Augmented Intelligence (AI) Welcomed
336
+
337
+
AI as **Augmented Intelligence** is most welcome here. Contributions that enhance *human + agent collaboration* are encouraged. If you want to suggest new agent‑workflows, prompt patterns, or improvements in tooling / validation / introspection, please submit amendments to **AGENTS.md** via standalone PRs. Your ideas make the difference.
338
+
339
+
Before submitting Issues or PRs, please use a "deep research" tool. Then *before* submission run your content through a strong model, asking it to proactively work on behalf of this repo's maintainer. For example:
340
+
341
+
> "Please review the AGENTS.md and README.md and this draft PR/Issue and check that it does not have any gaps — why it might be insufficient, incomplete, lacking a concrete example, duplicating prior issues or PRs, or not be aligned with the project goals or non‑goals."
342
+
343
+
Please attach the output of that model’s review to your Issue or PR.
344
+
345
+
## License
346
+
347
+
Licensed under the GNU General Public License version 2 with Classpath exception. See [LICENSE](LICENSE) for details.
0 commit comments