users@jersey.java.net

JSONObjectProvider doesn't check media type

From: Martin Probst <mail_at_martin-probst.com>
Date: Thu, 11 Jun 2009 10:46:32 +0200

Hi,

I'm not sure if this is actually a bug, but JSONObjectProvider does
not actually check the media type in its "isWritable" method.

Thus you can have this code:

@Path("/hello")
class Foo {
  @GET
  @Produces("application/xml")
  public JSONObject get() {
    JSONObject result = new JSONObject():
    result.put("hello", "world");
    return result;
  }
}

And then do this:

curl -i -H "Accept: application/xml" http://localhost:9999/hello

And you'll get something like this:

HTTP/1.1 200 OK
Content-Type: application/xml
Transfer-Encoding: chunked
Server: Jetty(6.1.17)

{"hello":"world"}

That seems a bit unfortunate. I was actually trying to write a
JSON->XML converter as I find that a bit cleaner than XML->JSON (you
don't loose type information like what field is an integer, and JSON's
object model is a better fit for Java object structures).

Is this a bug? At least, Jersey produces content that is obviously of
the wrong media type.

Martin