SpiderLabs/ModSecurity — pull request #24 by urma (2013-01-01 22:31:03+00:00)
Title: JSON Body Processor

After a long time tinkering with the mapping between JSON and ARGS, the JSON body processor is finally ready for a first review. A brief description:

* It uses yajl (http://lloyd.github.com/yajl/) for streaming JSON parsing
* Only leaf nodes in the JSON stream will be registered under ARGS, because we currently only assign scalar values to ARGS, not JSON structures:
{ 'data': { 'a': 1, 'b': 2 } } would result in ARGS:data.a = 1 and ARGS:data.b = 2, but ARGS:data would be undefined
* Multiple values for a given key are supported, but due to the previous mapping method, there is no way to distinguish between some scenarios:
[ { 'data': 1 }, { 'data': 2 } ] would result in ARGS:data = 1 and ARGS:data = 2, while
{ 'data': [ 1, 2 ] } would also result in ARGS:data = 1 and ARGS:data = 2

There are some TODO comments in the msc_json.c code which indicate aspects of the code I am not sure if I got right -- any feedback on those would be much appreaciated.