users@jersey.java.net

Re: [Jersey] JSONObjectProvider doesn't check media type

From: Paul Sandoz <Paul.Sandoz_at_Sun.COM>
Date: Thu, 11 Jun 2009 11:28:10 +0200

On Jun 11, 2009, at 11:22 AM, Bruno Vernay wrote:

> There could be a compile time error, but the code looks wrong since
> you explicitly create JSON and declare that it is XML.
>

It is not wrong in the sense of how the related MessgeBodyWriter is
declared:

public class JSONObjectProvider extends
AbstractMessageReaderWriterProvider<JSONObject>{

     public JSONObjectProvider() {
         Class<?> c = JSONObject.class;
     }


Because the JSONObjectProvider does not have an @Produces annotation
it supports any media type, including ones declared by the application
that contradict the information that is produced.

We need to modify this to support: application/json and application/
<xxxx>+json

When it is modifed you will get an error if @Produces("application/
xml") is declared on a resource method as the JSONObject will then not
be supported for that media type.

Martin could you log an issue?

Thanks,
Paul.

> Bruno
>
>
> On Thu, Jun 11, 2009 at 10:46 AM, Martin Probst<mail_at_martin-
> probst.com> wrote:
>> Hi,
>>
>> I'm not sure if this is actually a bug, but JSONObjectProvider does
>> not actually check the media type in its "isWritable" method.
>>
>> Thus you can have this code:
>>
>> @Path("/hello")
>> class Foo {
>> @GET
>> @Produces("application/xml")
>> public JSONObject get() {
>> JSONObject result = new JSONObject():
>> result.put("hello", "world");
>> return result;
>> }
>> }
>>
>> And then do this:
>>
>> curl -i -H "Accept: application/xml" http://localhost:9999/hello
>>
>> And you'll get something like this:
>>
>> HTTP/1.1 200 OK
>> Content-Type: application/xml
>> Transfer-Encoding: chunked
>> Server: Jetty(6.1.17)
>>
>> {"hello":"world"}
>>
>> That seems a bit unfortunate. I was actually trying to write a
>> JSON->XML converter as I find that a bit cleaner than XML->JSON (you
>> don't loose type information like what field is an integer, and
>> JSON's
>> object model is a better fit for Java object structures).
>>
>> Is this a bug? At least, Jersey produces content that is obviously of
>> the wrong media type.
>>
>> Martin
>>
>> ---------------------------------------------------------------------
>> To unsubscribe, e-mail: users-unsubscribe_at_jersey.dev.java.net
>> For additional commands, e-mail: users-help_at_jersey.dev.java.net
>>
>>
>
>
>
> --
> Bruno VERNAY
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe_at_jersey.dev.java.net
> For additional commands, e-mail: users-help_at_jersey.dev.java.net
>