4 ms·

I use XSD a lot for XML validation in .net world and better intellisense when writing XML by hand. I was exploring the json world but I could not find a json sc

by pingec 8y ago

I use XSD a lot for XML validation in .net world and better intellisense when writing XML by hand. I was exploring the json world but I could not find a json schema technology that would be as expressive and the tooling around it is much inferior IME. I feel like the technology around schemas (json, xml or anything else) is underrated and not developed enough. And if I wanted to support both json and xml it would be such a pain to maintain, would be nice to have a tool that could translate xml schema to json schema and back.

lwansbrough 8y ago
I’ll pass on any serialization format that is itself vulnerable to RCE.
- eridius 8y ago
  You can easily create a parser with RCE using just JSON. Just define a simple schema that looks like { "type": "ObjectName", … } The only difference between this and e.g. YAML is YAML has specific syntax for declaring the object type whereas with JSON you need to declare it yourself.
senozhatsky 8y ago
> would be nice to have a tool that could translate xml schema to json schema and back. Hmm, after a quick search I found a bunch of json-to-xml and xml-to-json converters, including libraries. E.g. JSON-Java library [0]. May be same things exist for .Net. Is this what you meant? [0] https://github.com/stleary/JSON-java https://github.com/stleary/JSON-java -ss
- bouke 8y ago
  I think parent was talking about the document definition (schema) instead. So not to rely on the document instance for the translation definition.
  - senozhatsky 8y ago
    Ah, got it. Thanks. I wasn't entirely sure, admittely not a very experienced json user. Does term "schema" apply to json in the same way it applies to XML? /* Well... so... One can convert JSON to XML and apply XML schema verification. That's partly a joke :) */ -ss
bouke 8y ago
> would be nice to have a tool that could translate xml schema to json schema and back. I once worked with a customer that bolted a JSON frontend onto an existing XML backend. However the translation definition was not predefined but determined at runtime. Some XML node could have 1+ children but because of this translation the result would either be an object (1), or an array of objects (2+). Needless to say the implementation in the consumer became rather messy, having to deal with this dynamic structure.

by pingec 8y ago

lwansbrough 8y ago

I’ll pass on any serialization format that is itself vulnerable to RCE.

eridius 8y ago
You can easily create a parser with RCE using just JSON. Just define a simple schema that looks like { "type": "ObjectName", … } The only difference between this and e.g. YAML is YAML has specific syntax for declaring the object type whereas with JSON you need to declare it yourself.

senozhatsky 8y ago

> would be nice to have a tool that could translate xml schema to json schema and back. Hmm, after a quick search I found a bunch of json-to-xml and xml-to-json converters, including libraries. E.g. JSON-Java library [0]. May be same things exist for .Net. Is this what you meant? [0] https://github.com/stleary/JSON-java https://github.com/stleary/JSON-java -ss

bouke 8y ago
I think parent was talking about the document definition (schema) instead. So not to rely on the document instance for the translation definition.
- senozhatsky 8y ago
  Ah, got it. Thanks. I wasn't entirely sure, admittely not a very experienced json user. Does term "schema" apply to json in the same way it applies to XML? /* Well... so... One can convert JSON to XML and apply XML schema verification. That's partly a joke :) */ -ss

bouke 8y ago

> would be nice to have a tool that could translate xml schema to json schema and back. I once worked with a customer that bolted a JSON frontend onto an existing XML backend. However the translation definition was not predefined but determined at runtime. Some XML node could have 1+ children but because of this translation the result would either be an object (1), or an array of objects (2+). Needless to say the implementation in the consumer became rather messy, having to deal with this dynamic structure.