core-json: A non-allocating no-std JSON deserializer

86 points kayabaNerve 14 comments

I recently implemented a niche self-describing serialization format in Rust and made a deserializer which didn't allocate to avoid memory-exhaustion attacks by malicious clients/servers. I noted the same techniques would apply to JSON, which would be far more useful to the community as a whole, so I built a RFC 8259-compliant deserializer which works with `core` alone.

The README covers why in greater detail, including the methodology, with comparisons to other existing crates. The main comparable would be docs.rs/serde-json-core/ which does not support deserializing unknown fields and requires the type definition be known ahead of time. In comparison, `core-json` allows deserializing arbitrary objects at runtime with runtime checks for their type and dynamic conversion into typed objects.

`core-json-traits` then provides the struct for deserializing into typed objects, with `core-json-derive` allowing automatically deriving `JsonDeserialize` for user-defined structs. This means it can be as easy to use as a `serde` deserializer, but with a bit more flexibility at runtime despite only requiring `core`. A long-term goal will presumably be to offer a feature-set comparable to `miniserde` while maintaining a more minimal (non-allocating) codebase itself.