JSON Patch

What’s nice about JSON is that it’s actually valid JavaScript, with some formal specification to avoid any nasty circles or injections.

Why can’t your protocol just be valid JavaScript too? this.name = “string”; instead of mixing so many metaphors?

Because that would require consumers to have a Javascript interpreter to use it.

> Why can’t your protocol just be valid JavaScript too?

It is.

Because that would require consumers to have an interpreter for the most widely deployed language, ever, and by far.

FTFY

It’s delivered in JSON, but you need an interpreter. But the actions are just JS assignment statements and a little glue. Your interpreter could as easily handle that, and with far less bytes. Why call a member variable /name when it’s already .name?

security nightmare; sometimes you don't want consumers to execute code arbitrarily

Nah, in that case Python would be a better option as it's already installed everywhere.

That is so derangedly untrue.

Not true. Google, Meta, ... do it at a massive scale, no issues.

It's not really hard to protect yourself against that.

Any (competent) security guy can give you like 4 ways to implement it properly.

This is what makes Tcl great as a data interchange format. It comes with a safe mode for untrusted code and you can further restrict it to have no control flow commands to be non-Turing.

But what's your point? Would you truly want consumers of JSON Patch data to embed a JS interpreter?

My point is that the JS interpreter is likely already there.

Starlark is a nice embeddable scripting language, though. Java, Go, and Rust implementations: https://github.com/bazelbuild/starlark/blob/master/users.md#...

Do you mean the ads they serve that contain malware?

Ok hear me out, what if my API accepts WASM fragments that I run against my database but in a sandbox!

I am a (hopefully competent) security guy, please don't run arbitrary code if you can help it. Especially for something as trivial as JSON patching.

only if you think of JSON in the context of a browser. JSON is used as serialized representation of objects in embedded systems, config files, etc. where a JS interpreter is unnecessary, absent or unwanted (size, security, platform preferences, ...)