java-json-benchmark VS jackson-databind

https://github.com/fabienrenaud/java-json-benchmark is an older benchmark. Jsoniter / DslJson haven't really had updates in a while.

It depends. Some binary encodings such as flatbuffer are actually slower than some JSON libraries. There's a wide range of performance even in the JSON libraries themselves. Generally the faster JSON libraries are the ones that work on a predefined schema and so are able to generate code specifically for that JSON.

The org.json library is a great little library,. I use it all the time. Just make sure you don't use it for anything that you want to be high performance... We noticed a bottle neck in our application around the reading and writing of json. I did a little reading and found that it was one of the slower libraries out there. https://github.com/fabienrenaud/java-json-benchmark

Jackson had this problem a few months back, where someone reported a critical CVE against the project and broke builds all around the planet https://github.com/FasterXML/jackson-databind/issues/3972

Basically the programmer (not the attacker) had to write code where an object contained itself

HashMap map=new HashMap<>();

map.put("recursive",map);

After this, Jackson would indeed stack overflow if you asked it to wrap the object to JSON. Then again, half the build-in Java functions (e.g. getting an object hashcode for the map object) also fail for a recursive structure.

The issue remains open 3 months later, Mitre still thinks it's hella serious, and people have yet again learned to just ignore their CI warning about CVEs

jackson-databind maintainer responds to a similar occurrence few weeks ago: https://github.com/FasterXML/jackson-databind/issues/3972#is...

As to Jackson itself see https://github.com/FasterXML/jackson-databind/issues/1970 for example on startup issues. There are others.

after reading https://github.com/FasterXML/jackson-databind/issues/2239 but setting JsonCreator and adding the JsonFormat didn't work.

Jackson should support records out of the box https://github.com/FasterXML/jackson-databind/issues/2709

Its not like this vulnerability is something new. Similar issues have been public knowledge for at least four years and discussed widely. The fact that str to int and int to str conversions are slow for huge ints is hardly news.

In C#, Newtonsoft Json has similar functionality, and in Java — Jackson2 ObjectMapper.