The java-json-canonicalization from erdtman

java-json-canonicalization's People

Contributors

Stargazers

Watchers

java-json-canonicalization's Issues

Issue with canonicalisation of JSON object with certain JSON array member

Hey,

I'd like to report an issue that we managed to finally pin down today.

I'm pasting the concrete JSON that was causing different outputs of the JsonCanonicalizer for a given string:

String jsonIn = "{\"sub\":\"alice\",\"cid\":\"1\",\"scp\":[\"openid\",\"email\"],\"irt\":false,\"rtl\":-1,\"atl\":300,\"ate\":\"S\",\"atc\":false,\"iat\":1613669294,\"clm\":[\"email_verified\",\"email\"],\"rts\":\"_bM0U_knzP20VzbVAuzmvA\",\"k\":\"[\\\"alice\\\",\\\"\\\",\\\"1\\\"]\",\"tid\":\"t2\"}";
		
System.out.println(new JsonCanonicalizer(jsonIn).getEncodedString());
		
String jsonOut = "{\"sub\":\"alice\",\"scp\":[\"openid\",\"email\"],\"clm\":[\"email\",\"email_verified\"],\"irt\":false,\"rtl\":-1,\"k\":\"[\\\"alice\\\",\\\"\\\",\\\"1\\\"]\",\"tid\":\"t2\",\"rts\":\"_bM0U_knzP20VzbVAuzmvA\",\"atc\":false,\"ate\":\"S\",\"atl\":300,\"iat\":1613669294,\"cid\":\"1\"}";
		
System.out.println(new JsonCanonicalizer(jsonOut).getEncodedString());

The first printout produces:

{"atc":false,"ate":"S","atl":300,"cid":"1","clm":["email_verified","email"],"iat":1613669294,"irt":false,"k":"[\"alice\",\"\",\"1\"]","rtl":-1,"rts":"_bM0U_knzP20VzbVAuzmvA","scp":["openid","email"],"sub":"alice","tid":"t2"}

The second:

{"atc":false,"ate":"S","atl":300,"cid":"1","clm":["email","email_verified"],"iat":1613669294,"irt":false,"k":"[\"alice\",\"\",\"1\"]","rtl":-1,"rts":"_bM0U_knzP20VzbVAuzmvA","scp":["openid","email"],"sub":"alice","tid":"t2"}

The difference is in the ordering of the items in the "clm" JSON array - "email" and "email_verified".

The library was used to append HMACs to items stored in DynamoDB, which returns the JSON in non-deterministic order, hence the need for canonicalisation.

Version is 1.1.