Prevent Newtonsoft JSON deserializer from accepting strings with new lines (enforce strict JSON rules)?

Question

Json.Net allows new lines in a string value during deserialization which is against the JSON specification - how to prevent that and make JSON.Net to strictly enforce JSON rules?

We have some server side code that uses Newtonsoft to parse some JSON. The same JSON seems to fail to parse in javascript, and mysql's JSON_VALID function returns 0. Just wondering if there is a way to have Newtonsoft be more strict about deserialization. Example, here is code that runs, that should throw an exception because JSON can not have embedded new lines in strings.

string jsonStr = "{ \"bob\":\"line1\nline2\" }";
var obj = Newtonsoft.Json.JsonConvert.DeserializeObject(jsonStr);

If you look at jsonStr in the debugger, specifically using the text visualizer, you see the line break. As expected this exact string gets passed to an actual JavaScript engine, parsing fails:

 JSON.parse("{ \"bob\":\"line1\nline2\" }")

VM137:1 Uncaught SyntaxError: Unexpected token

Note that serialization code seems to do the "right" thing. i.e. escapes the slash in the new line when creating output.

public class Test
{
    public string Name { get; set;}
}
Test t = new Test();
t.Name = "Bob\nFrank";
string jsonOut = Newtonsoft.Json.JsonConvert.SerializeObject(t);

Am I missing something?

Answer 1

I've debugged the Newtonsoft Json.NET and I'll say you can't. Everything that is interesting happens in the JsonTextReader class, and there is no useful override point. The path you are interested in is Read()->ParseValue()->ParseString()->ReadStringIntoBuffer() and there, toward the end there are:

case StringUtils.CarriageReturn:
    _charPos = charPos - 1;
    ProcessCarriageReturn(true);
    charPos = _charPos;
    break;
case StringUtils.LineFeed:
    _charPos = charPos - 1;
    ProcessLineFeed();
    charPos = _charPos;
    break;

that will "accept" newlines inside strings.

Worse, there is not even an overridable method or event about "begin and end of string parsing".

You could clearly rewrite the whole JsonTextReader, but you can't simply copy and paste it in a new file, because it uses internal classes of Json.NET (like StringBuffer, StringReference, StringUtils, CollectionUtils, ConvertUtils, MiscellaneousUtils (but only for .Assert) plus internal methods of JsonReader...)

Remember that if all you want is check if the Json is valid, you can try the other parsers that exist. Microsoft gives you two: there is the (old)JavascriptSerializer and the (new)JsonSerializer.