Issue #240 - added support for "reject duplicate keys" config option

[JohnTimm]

Signed-off-by: John T.E. Timm johntimm@us.ibm.com

[leadpony]

@JohnTimm @lukasj

• JsonReaferFactory#getConfigInUse() must return all configuration properties it recognized.
• I feel FORBID_DUPLICATE_KEYS is better naming than ALLOW_DUPLICATE_KEYS, because the property does not exist in the configuration properties by default and such default state means allow duplicate keys.

[JohnTimm]

@JohnTimm @lukasj

• JsonReaderFactory#getConfigInUse() must return all configuration properties it recognized.

I have updated the code to pass the configuration object into JsonReaderFactoryImpl (in a similar fashion to JsonGeneratorFactoryImpl).

• I feel FORBID_DUPLICATE_KEYS is better naming than ALLOW_DUPLICATE_KEYS, because the property does not exist in the configuration properties by default and such default state means allow duplicate keys.

I renamed ALLOW_DUPLICATE_KEYS to FORBID_DUPLICATE_KEYS and updated the logic accordingly. Please see my latest commit.

[m0mus]

Make sure that the copyright year is updated to 2020 in all files you changed.

[JohnTimm]

Make sure that the copyright year is updated to 2020 in all files you changed.

Updated copyright date on JsonObjectBuilderImpl. Please see my latest commit.

[JohnTimm]

@lukasj @m0mus Is there a chance for this PR to make it into the next release candidate?

[JohnTimm]

Make sure that the copyright year is updated to 2020 in all files you changed.

@m0mus Your requested changes have been addressed. What do we need to do to move this PR forward?

[nmittles]

@m0mus Hi Dmitry. Is there anything holding this PR out? It looks like John has made all the requested changes.

[JohnTimm]

@lukasj @m0mus This has been sitting here for months. Please let me know if more needs to be done before it can be merged.

[lukasj]

We did not want this in 2.0.0 and currently waiting for master to open up for integrations (expect ~2-3 weeks)

[JohnTimm]

We did not want this in 2.0.0 and currently waiting for master to open up for integrations (expect ~2-3 weeks)

Sounds good. Thanks for the quick response! I appreciate it.

[JohnTimm]

@lukasj Now that Jakarta EE 8 has shipped, where do we stand on getting this PR pulled into master?

[lmsurpre]

Bumped into this interesting article and it reminded me that we've been waiting on this pull request for 9 months: https://labs.bishopfox.com/tech-blog/an-exploration-of-json-interoperability-vulnerabilities

[lukasj]

Shouldn't JsonObjectBuilderImpl be the one to decide if the to be added key should be rejected or not? Or is it expected that parser.getObject() may reject the field while json.createObjectBuilder().add("firstName", "John").add("firstName", "Peter").build() is OK to not throw any errors when the reject option is set to true? This does not consistent to me.

[JohnTimm]

@lukasj Everything is done through JsonObjectBuilder now so that the behavior should be consistent. Please take a look at my recent commits. We'd like to get this functionality merged sooner than later.

[lukasj]

thanks!

[m0mus]

LGTM