ahdinosaur / json-canon

Serialize JSON into a canonical format.

json-canon

Serialize JSON into a canonical format.

Safe for generating a consistent cryptographic hash or signature across platforms.

Follows RFC8785: JSON Canonicalization Scheme (JCS)

Features

The JSON Canonicalization Scheme concept in a nutshell:

• Serialization of primitive JSON data types using methods compatible with ECMAScript's JSON.stringify()
• Lexicographic sorting of JSON Object properties in a recursive process
• JSON Array data is also subject to canonicalization, but element order remains untouched

Serializers

JavaScript: json-canon

const serialize = require('json-canon')

const json = {
  from_account: "543 232 625-3",
  to_account: "321 567 636-4",
  amount: 500,
  currency: "USD"
}

console.log(serialize(json))
// {"amount":500,"currency":"USD","from_account":"543 232 625-3","to_account":"321 567 636-4"}

Rust: json-canon

use json_canon::to_string;
use serde_json::json;

let data = json!({
    "from_account": "543 232 625-3",
    "to_account": "321 567 636-4",
    "amount": 500,
    "currency": "USD"
});

println!("{}", to_string(&data)?);
// {"amount":500,"currency":"USD","from_account":"543 232 625-3","to_account":"321 567 636-4"}

Fuzzers

• JavaScript: json-canon-fuzz

References

• cyberphone/ietf-json-canon
• cyberphone/json-canonicalization

json-canon's Issues

Rust bug: large integers (beyond JavaScript's Number.MAX_SAFE_INTEGER) should error

any integer above JavaScript's Number.MAX_SAFE_INTEGER should error.

at the moment, we serialize them as is, which could lead to the following problem:

JSON.stringify(JSON.parse("[1152921504606846976,2305843009213693952,4611686018427387904]"))
// '[1152921504606847000,2305843009213694000,4611686018427388000]'

another option is we cast integers as f64, but this is lossy and i'd rather throw an error than silently convert data.

references:

• l1h3r/serde_jcs#3
• cyberphone/json-canonicalization#20

fuzz testing

needs more fuzz!

• numbers
• strings
• objects
  • sorting
  • nesting

Rust bug: number keys are not properly handled

failing test:

macro_rules! treemap {
    () => {
        BTreeMap::new()
    };
    ($($k:expr => $v:expr),+) => {
        {
            let mut m = BTreeMap::new();
            $(
                m.insert($k, $v);
            )+
            m
        }
    };
}

#[test]
fn test_object_with_wacky_keys() {
    #[derive(PartialEq, Eq, PartialOrd, Ord, serde_derive::Serialize)]
    #[serde(untagged)]
    enum Key<'a> {
        Str(&'a str),
        Num(u32),
    }
    let expected = r#"{"\n":"Newline","1":"One","2":"Two","3":"Three","4":"Four"}"#;
    let input = treemap![
        Key::Num(2) => "Two",
        Key::Str("4") => "Four",
        Key::Str("1") => "One",
        Key::Num(3) => "Three",
        Key::Str("\u{000a}") => "Newline"
    ];
    let actual = to_string(&input).unwrap();
    assert_eq!(actual, expected);
}

failures:

---- test_object_with_wacky_keys stdout ----
thread 'test_object_with_wacky_keys' panicked at 'assertion failed: `(left == right)`
  left: `"{\"2\":\"Two\",\"3\":\"Three\",\"\\n\":\"Newline\",\"1\":\"One\",\"4\":\"Four\"}"`,
 right: `"{\"\\n\":\"Newline\",\"1\":\"One\",\"2\":\"Two\",\"3\":\"Three\",\"4\":\"Four\"}"`', 

i'll admit i didn't realize numbers could be keys, but that's because i keep thinking that the Rust is deserialized to serde_json::Value (where keys can only be strings) before being serialized, which is just not the case.