Recursively decode JSON string until the decoded string is a valid JSON

Question

I have a one-time URL encoded string:

$encodedJson = "%5B%7B%0A%09%22base%22%3A%20%7B%0A%09%09%22url%22%3A%20%22abc.com%22%2C%0A%09%09%22referrer%22%3A%20%22xyz.com%22%0A%09%7D%0A%7D%2C%20%7B%0A%09%22client%22%3A%20%7B%0A%09%09%22Pixel%22%3A%20false%2C%0A%09%09%22screen%22%3A%20%221680x1050%22%0A%09%7D%0A%7D%5D"

If I use the following functions, I have a decoded JSON, which is an array:

$decodedJsonArray = json_decode(rawurldecode($encodedJson), true);

Then print_r($decodedJsonArray); gives me the desired output:

Array
(
    [0] => Array
        (
            [base] => Array
                (
                    [url] => abc.com
                    [referrer] => xyz.com
                )

        )

    [1] => Array
        (
            [client] => Array
                (
                    [Pixel] => 
                    [screen] => 1680x1050
                )

        )

)

Now, let's say I have a multiple-times URL encoded string:

$encodedJson = "%25255B%25257B%25250A%252509%252522base%252522%25253A%252520%25257B%25250A%252509%252509%252522url%252522%25253A%252520%252522abc.com%252522%25252C%25250A%252509%252509%252522referrer%252522%25253A%252520%252522xyz.com%252522%25250A%252509%25257D%25250A%25257D%25252C%252520%25257B%25250A%252509%252522client%252522%25253A%252520%25257B%25250A%252509%252509%252522Pixel%252522%25253A%252520false%25252C%25250A%252509%252509%252522screen%252522%25253A%252520%2525221680x1050%252522%25250A%252509%25257D%25250A%25257D%25255D"

This string is three-times URL encoded. Now, I want to achieve the same JSON array as before. I am trying to write a function similar to the following:

function recursiveJsonDecode($encodedJson) {
    if (isJson($encodedJson)) {
        return $encodedJson;
    } else {
        $decodedJsonArray = json_decode(rawurldecode($encodedJson), true);
        return $decodedJsonArray;
    }
}

But it's not working. Any help would be much appreciated.

Answer 1

Shipping & Post Office Supplies | USPS.com - Postal Store

Ordering shipping supplies is cute because it's the only time you can ever receive a box full of nothing but boxes!

When you receive your boxes in the mail, what do you do with them tho? I remove only the outermost packaging and set my boxes on a shelf; maybe I'll use them to send things out later. Someone that writes a recursive JSON decoder might do something differently tho – they might attempt to open all of those boxes and be sad to find out they received nothing!

"I opened every single box and I never found my order's contents!" the recursive JSON decoder laments

---

Don't decode it just because you can

There's no way to determine if a string is JSON encoded or not. Because of this, it's not the consumer's job to decide whether to parse or not.

Take for example, the JSON string, "5" – is it a single-encoded string of '5'?

json_encode("5");
// => '"5"'

or is it a double-encoded integer 5?

json_encode(json_encode(5));
// => '"5"'

If you're looking at the only the JSON-encoded result, there's no way to tell, but 5 (int) and "5" (string) are as different as [5] or {value: 5} – they're completely different types – The JSON consumer must know how many times the value has been encoded. That's not complicated, as you should avoid double-encoding in the first place.

---

When we decode JSON, we only do it once

json_decode('"5"');
// => "5"

Your recursive function would effectively do this

json_decode(json_decode('"5"'));
// => 5

Only one of those is a valid answer – this is why you see all isJson functions built around error-checking a decode operation – people trick themselves into thinking that just because you can decode a string, that it was JSON in the first place.

Returning to our USPS example, it would mean you only stop opening boxes once you encounter a thing that cannot be opened – I just keep opening boxes and once I discover they're all empty, I'm stuck wondering where my order contents are.

This idea that you can somehow detect when to stop decoding is broken from the start – In this example, watch what happens when I have a simple form submission and a recursive JSON decoder being used to process the submission...

If I fill in a form with my name "[]", and now you use a recursive JSON decoder on the submitted form data, you will end up with

$formData == [ "name" => [] ] // name is an array, wups!

Whereas a non-recursive JSON decoder would keep the name as a string

$formData == [ "name" => "[]" ] // name is a string, as the user typed

Just because you can parse it, doesn't mean you should

---

Once a string has been double or triple encoded (URL-encoded, JSON-encoded, or whatever-encoded)- the only way to reverse it is to decode it exactly the same amount of times

Answer 2

You can treat URL decoding as a fixed point operation:

function fixedPointDecode($string) {
     $decoded = urldecode($string); 
     while ($decoded != $string) {
         $string = $decoded;
         $decoded = urldecode($string);    
     }
     return $decoded;
}

The idea is that if the result of urldecode does not change the original string then it's fully decoded.

Then you can do:

 json_decode(fixedPointDecode($string));

Note: I have not found any indication that there are any URL encoded strings that do not converge to a fixed point but I'm curious if anyone else has.

Answer 3

json_decode will return null if it's not valid JSON as it says here:

NULL is returned if the json cannot be decoded or if the encoded data is deeper than the recursion limit.

So just test it:

while(($decodedJsonArray = json_decode($encodedJson, true)) === null) {
    $encodedJson = rawurldecode($encodedJson);
}

print_r($decodedJsonArray);

To use your isJson function:

while(!isJson($encodedJson)) {
    $encodedJson = rawurldecode($encodedJson);
}
$decodedJsonArray = json_decode($encodedJson, true);

print_r($decodedJsonArray);

Answer 4

Calling rawurldecode(rawurldecode(rawurldecode($encodedJson))) reveals that your string is actually rawurldecoded 3 times, not json_encoded 3 times, so I made the recursive function rawurldecode it on every iteration until the json_decode worked:

$encodedJson = "%25255B%25257B%25250A%252509%252522base%252522%25253A%252520%25257B%25250A%252509%252509%252522url%252522%25253A%252520%252522abc.com%252522%25252C%25250A%252509%252509%252522referrer%252522%25253A%252520%252522xyz.com%252522%25250A%252509%25257D%25250A%25257D%25252C%252520%25257B%25250A%252509%252522client%252522%25253A%252520%25257B%25250A%252509%252509%252522Pixel%252522%25253A%252520false%25252C%25250A%252509%252509%252522screen%252522%25253A%252520%2525221680x1050%252522%25250A%252509%25257D%25250A%25257D%25255D";

function recursiveJsonDecode ($inJson) {
    $outputArr = json_decode($inJson);
    if (json_last_error() == JSON_ERROR_NONE) {
        return $outputArr;
    } else {
        return recursiveJsonDecode(rawurldecode($inJson));
    }
}

print_r(recursiveJsonDecode($encodedJson));

eval.in demo