-
Notifications
You must be signed in to change notification settings - Fork 784
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Migrate away from yajl #6257
Comments
Please note that new features which require additional configuration will usually not be considered. We are happy with the feature set of i3 and want to focus in fixing bugs instead. We do accept feature requests, however, and will evaluate whether the added benefit (clearly) outweighs the complexity it adds to i3. Keep in mind that i3 provides a powerful way to interact with it through its IPC interface: https://i3wm.org/docs/ipc.html. |
I think that's a good idea but there is a lot of code that is tightly coupled with json parsing unfortunately. The effort here would be quite significant. Thoughts @stapelberg? |
Thanks for the hint, I didn’t realize yajl had become stale. While I’m not too worried about the CVEs (i3 doesn’t parse untrusted JSON), it is concerning that distribution maintainers want to drop yajl, so yes, we should probably migrate i3 to some other library. I made a note to cut a new release soon (maybe end of next week) and then we can accept PRs which convert i3 piece by piece to a new JSON library. It’s probably easiest to start with the standalone tools like i3-msg. |
Good idea about the piece-by-piece migration. WDYT about having a separate experimental branch for the json migration at least in the beginning? |
With which json library should we go? json-c? |
Ideally, before starting on an implementation, the first work item would be to have a quick comparison between the alternatives.
Options that seem less suiting:
Ultimately, from the top of my head, we want a library that:
|
json-c seems to be the much more popular option compared to runner-up cJSON. I can’t find parson in Debian at all. If json-c seems usable, it seems like a good choice from what I can tell. |
Haven't looked into either yet but what is this based on? cJSON has 3x the stars. |
This was based on looking at how many packages declare a build-dependency by searching Debian Code Search:
(You can also do these reverse-dependency queries by querying apt, but I found it easiest to use Code Search here.) |
Looks like the json-c parser supports comments directly, unless you use the
Probably the most problematic thing here is the overflow handling for integer numbers (but i3 should not be receiving untrusted JSON anyway, so this might be acceptable). Also, once trailing commas would start to be supported, getting rid of them without breaking compatibility would be impossible. cJSON seems to be much more stricter — its parser does not supports comments, trailing commas, or the non-standard single quotes for strings. Comments in JSON are “supported” only by the Also cJSON parses all numbers as In addition, both of those implementation do not support null characters ( I also looked at jansson, and that library explicitly does not support any JSON syntax extensions, including comments. |
Thanks for looking into this and sharing your findings. I think we can probably live with not setting JSON_TOKENER_STRICT, i.e. with accepting all the non-standard behavior. The only item that I can imagine people accidentally running into is the single quotes for strings, and that’s easy enough to fix in, say, a saved layout file. Given that we released v4.24 recently, it seems like the best course of action is now clear: convert piece-by-piece to json-c. |
There is a conceptual difference between
Similarly, The DOM-like API would simplify the code, but it would make performance worse as it performs a lot of allocations. I migrated IPC serializer code for Current
My
|
Thank you @xzfc, that's really illuminating. I am afraid that a performance degradation like this is a significant issue, i3 depends on a lot of JSON parsing/serialising so we should consider this aspect before moving with json-c prematurely. Are there any other event-driven json libraries out there? |
Non-DOM libraries:
Also, it worth considering vendoring small JSON dependencies (or adding them as submodules or rolling our own), so we don't rely on having them in distro repos. E.g. Also, there is https://github.com/ibireme/yyjson. It's DOM-like, but it claims to be extremely fast. |
Welcome
Impact
Current Behavior
i3 currently uses yajl for json serialization. Unfortunately, yajl is pretty much dead upstream now and according to the current maintainer in Fedora, it has collected quite a number of CVEs and they'd like to eventually stop maintaining it or remove it from the distribution entirely (see: https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org/message/YPFHPOKAND3RZR7ZKWTDHUQEESG6IUJ3/).
Desired Behavior
Migrate to a maintained json library, e.g. json-c (this library is also used by sway).
I'd be willing to help out in such an effort, but only if there's any chance that this will land upstream in i3.
The text was updated successfully, but these errors were encountered: