Skip to content

Prevent urlencoded content foo=bar from being deserialized when serializer is set to JSON#1771

Open
icyavocado wants to merge 2 commits intoPerlDancer:mainfrom
icyavocado:pr/issue-1770-allow-urlencoded-data-in-serializer-json
Open

Prevent urlencoded content foo=bar from being deserialized when serializer is set to JSON#1771
icyavocado wants to merge 2 commits intoPerlDancer:mainfrom
icyavocado:pr/issue-1770-allow-urlencoded-data-in-serializer-json

Conversation

@icyavocado
Copy link
Contributor

This PR will allow sending requests with URL-encoded content, eg: foo=bar, to the Dancer2 route, even when the serializer is set to JSON

Test added to support this new behavior.

Resolve ##1770

- set serializer to JSON, and turn on canonical for a more reliable test
- passing conent `foo=bar&bar=` with application/x-www-form-urlencoded
- return body_parameters and expect the data returns JSON
- the body contents shouldn't look like JSON and contains an `=`
- header should be set to application/x-www-form-urlencoded
@icyavocado icyavocado changed the title Allow urlencoded content foo=bar from being deserialized when serializer is set to JSON Prevent urlencoded content foo=bar from being deserialized when serializer is set to JSON Mar 2, 2026
@xsawyerx
Copy link
Member

xsawyerx commented Mar 2, 2026

When you set JSON serializer on, you're essentially saying "assume everything received should be decoded from JSON and everything sent should be encoded to JSON" but this says "well, except..." and I'm not sure that's a good idea.

Setting an automatic serializer is good for very restricted situations in which you have an app that shouldn't receive input (or send output) in any other format. We shouldn't be fitting it to various edge-cases.

However, @veryrusty is the expert on serializers. :)

@icyavocado
Copy link
Contributor Author

icyavocado commented Mar 3, 2026

I will wait for a suggestion from the team!

Here is my thought process:
I understand that when you set the serializer => "JSON", it would not accept any type of data that is not JSON, and the result is throwing an error.

In this example, the request declared that the data is not JSON, and in this case, using url encoded header. So, I am thinking Dancer2::Core::JSON should be flexible and not try to deserialize the raw data while preserving the serialization of the return data.

I also can also see something like this #1577 would work in term of having to maintain my own version of JSON that allowed the behaviour.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants