Prior to Bug 39184, some libraries have been using PERL in their notices to parse JSON data. With PERL disallowed in notices, we need a way to handle JSON using Template Toolkit. https://metacpan.org/pod/Template::Plugin::JSON
Created attachment 183334 [details] [review] Bug 40164: Add Template::Plugin::JSON dependency Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
I've taken a look at Template::Plugin::JSON, JSON, and JSON::XS and I think overall this should be OK. There are some security considerations mentioned in JSON::XS, but I don't think it's anything that isn't already a potential problem. I thought about creating a Template::Plugin::XML at one point, but it had too many security issues, so I ended up raising bug 39296 to add a Template plugin that lets you take MARCXML and manipulate it with MARC::Record. You might find that one interesting too.
I added bug 39184 as a dependency but technically it's not.
Created attachment 183362 [details] [review] Bug 40164: Add Template::Plugin::JSON dependency Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io> Signed-off-by: David Cook <dcook@prosentient.com.au>
I think we should have a test for this.
(In reply to Jonathan Druart from comment #5) > I think we should have a test for this. Not a bad idea. What do you have in mind?
(In reply to Jonathan Druart from comment #5) > I think we should have a test for this. Do we actually have any test for notices using *any* TT plugin?
(In reply to Tomás Cohen Arazi (tcohen) from comment #7) > (In reply to Jonathan Druart from comment #5) > > I think we should have a test for this. > > Do we actually have any test for notices using *any* TT plugin? Touché! I don't know specifically about tests for notices using TT plugins, but we do have some unit tests for home-made TT plugins like t/Koha/Plugins/SafeURL.t, It's not clear to me what we'd be trying to test when bringing in a third-party plugin though. I suppose we could test that the plugin does what we're hoping/wanting/expecting it to do, so that if there is an upstream change we catch it early. But I don't know.
(In reply to Tomás Cohen Arazi (tcohen) from comment #7) > (In reply to Jonathan Druart from comment #5) > > I think we should have a test for this. > > Do we actually have any test for notices using *any* TT plugin? I agree it would be useful to have a test, using this TT plugin. And document how to use it for end users. The test should help us detect breaking changes in the plugin. I agree with adding them. Maybe in a separate bug. Will try tomorrow at the office