JSON.parse with reviver parameter to whitelist object fields

Question

I am writing a Node.js server which needs to accept a stringified JSON object in one of its services. I also want to whitelist certain fields in the JSON object. Both of these tasks should be accomplishable using JSON.parse() with the reviver parameter.

For some reason, trying to whitelist fields based on the key returns undefined for me. Curiously, I am able to successfully blacklist fields, as seen in this jsfiddle.

Can anyone explain this behavior and fix the first console.log statement to return {a="A"}?

This is really f***ing my brain. Can't wait to see the answer... — Jordan Soltman, Mar 21 '17 at 20:38
Figured it out: http://stackoverflow.com/questions/10595386/using-a-json-parse-reviver-to-obfuscate-fields — Jordan Soltman, Mar 21 '17 at 20:40

x-ray · Accepted Answer · 2017-03-21T20:56:07.483

The reviver callback is called for each property of the JSON object, including nested properties, and finally for the object itself. So the last call of the reviver callback will get key = '' and value = [the JSON object] as arguments. '' is not equal to 'a', so your reviver callback returns undefined when it is called for the last time for the whole object. This is why you see undefined for your "whitelisting" approach.

Another problem will arise when you use your approach on nested objects:

var test = "{\"a\": { \"a\": \"A\", \"d\": \"D\" }, \"b\": \"B\", \"c\": \"C\"}";

console.log(JSON.parse(test, function(key, val){ if (key === "a" || key === "") return val; }));
//  { a: { a: 'A' } }  <-- property d is missing

You could e.g. use lodash's _.pick or a JSON schema validator like ajv to whitelist properties. Or you could simply delete unwanted properties:

var whitelist = ['a'];
for (var prop in jsonObject) {
    if (!jsonObject.hasOwnProperty(prop)) continue;
    if (whitelist.indexOf(prop) === -1) delete jsonObject[prop];
}

The key isn't necessarily undefined. It's coming through as an empty string for me (chrome). — Jordan Soltman, Mar 21 '17 at 20:44

score 2 · Answer 2 · answered Mar 21 '17 at 20:45

The reviver is called 3 times + 1 final time with key as empty to indicate the object has been parsed.

    var test = "{\"a\": \"A\", \"b\": \"B\", \"c\": \"C\"}";
    var res = JSON.parse(test,function(key, val){
    console.log(key,key=="");
    if (key === "b" ) {
        return val;
    } else if (key==""){
        return val;
    }});
    console.log(res);

JSON.parse with reviver parameter to whitelist object fields

2 Answers2