Subject: [Json] Fixing the U+2028 and U+2029 problem

From: John Cowan <[email-masked]>
Date: Fri, 1 Aug 2014 17:10:23 -0400

The unescaped characters U+2028 (LINE SEPARATOR) and U+2029 (PARAGRAPH
SEPARATOR) are valid in JSON strings, but illegal in JavaScript strings.
It's too late to warn about this in RFC 7159, but can we get a requirement
to escape these two characters into the definition of I-JSON, please?
It's a minor gotcha, but still a gotcha.

-- 
John Cowan          http://www.ccil.org/~cowan        [email-masked]
Knowledge studies others / Wisdom is self-known;
Muscle masters brothers / Self-mastery is bone;
Content need never borrow / Ambition wanders blind;
Vitality cleaves to the marrow / Leaving death behind.    --Tao 33 (Bynner)

---

From: Carsten Bormann <[email-masked]>
Date: Sat, 2 Aug 2014 01:58:46 +0200

> It's a minor gotcha, but still a gotcha.

I actually think it would be good to explicitly document this as a non-goal.  As in:

“Although JSON started out as a strict subset of the JavaScript language, changes to JavaScript have caused this to be no longer true.  There is no expectation that an I-JSON generator will restrict itself to a subset of modern JavaScript, specifically, there is no expectation that U+2028 (LINE SEPARATOR) and U+2029 (PARAGRAPH
SEPARATOR) are escaped in strings.”

(Rationale: using JavaScript’s eval for decoding JSON is strongly discouraged.)

Grüße, Carsten