JSONPath: Query expressions for JSON

1.1. Terminology

The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 [RFC2119] [RFC8174] when, and only when, they appear in all capitals, as shown here.¶

The grammatical rules in this document are to be interpreted as ABNF, as described in [RFC5234]. ABNF terminal values in this document define Unicode code points rather than their UTF-8 encoding. For example, the Unicode PLACE OF INTEREST SIGN (U+2318) would be defined in ABNF as %x2318.¶

The terminology of [RFC8259] applies except where clarified below. The terms "Primitive" and "Structured" are used to group different kinds of values as in Section 1 of [RFC8259]; JSON Objects and Arrays are structured, all other values are primitive. Definitions for "Object", "Array", "Number", and "String" remain unchanged. Importantly "object" and "array" in particular do not take on a generic meaning, such as they would in a general programming context.¶

Additional terms used in this specification are defined below.¶

Value:

As per [RFC8259], a structure conforming to the generic data model of JSON, i.e., composed of components such as structured values, namely JSON objects and arrays, and primitive data, namely numbers and text strings as well as the special values null, true, and false. [RFC8259] focuses on the textual representation of JSON values and doesn't fully define the value abstraction assumed here.¶

Member:

A name/value pair in an object. (A member is not itself a value.)¶

Name:

The name (a string) in a name/value pair constituting a member. This is also used in [RFC8259], but that specification does not formally define it. It is included here for completeness.¶

Element:

A value in a JSON array.¶

Index:

A non-negative integer that identifies a specific element in an array. Note that the term indexing is also used for accessing elements using negative integers (Section "Semantics"), and for accessing member values in an object using their member name.¶

Query:

Short name for a JSONPath expression.¶

Argument:

Short name for the value a JSONPath expression is applied to.¶

Location:

the position of a value within the argument. This can be thought of as a sequence of names and indexes navigating to the value through the objects and arrays in the argument, with the empty sequence indicating the argument itself. A location can be represented as a Normalized Path (defined below).¶

Node:

The pair of a value along with its location within the argument. Member names do not have locations and so do not have nodes. Members are not values and so do not have nodes. Note that a node is either the root node (defined below) or one of its descendants (also defined below).¶

Root Node:

The unique node whose value is the entire argument.¶

Children (of a node):

If the node is an array, the nodes of its elements. If the node is an object, the nodes of its member values. If the node is neither an array nor an object, it has no children. Note that the members and member names of an object do not have nodes.¶

Descendants (of a node):

The children of the node, together with the children of its children, and so forth recursively. More formally, the descendants relation between nodes is the transitive closure of the children relation.¶

Depth (of a descendant node within a value):

The number of ancestors of the node within the value. The root node of the value has depth zero, the children of the root node have depth one, their children have depth two, and so forth.¶

Segment:

One of the constructs which select children ([]) or descendants (..[]) of an input value.¶

Nodelist:

A list of nodes. While a nodelist can be represented in JSON, e.g. as an array, this specification does not require or assume any particular representation.¶

Normalized Path:

A simple form of JSONPath expression that identifies a node in a value by providing a query that results in exactly that node. Similar to, but syntactically different from, a JSON Pointer [RFC6901].¶

Unicode Scalar Value:

Any Unicode [UNICODE] code point except high-surrogate and low-surrogate code points. In other words, integers in either of the inclusive base 16 ranges 0 to D7FF and E000 to 10FFFF. JSON string values are sequences of Unicode scalar values.¶

Singular Path:

A JSONPath expression built from segments each of which, regardless of the input value, produces at most one node.¶

Selector:

A single item within a segment that takes the input value and produces a nodelist consisting of child nodes of the input value.¶

1.2. History

This section is informative.¶

This document picks up Stefan Gössner's popular JSONPath proposal dated 2007-02-21 [JSONPath-orig], builds on the experience from the widespread deployment of its implementations, and provides a normative definition for it.¶

Appendix A describes how JSONPath was inspired by XML's XPath [XPath].¶

JSONPath was intended as a light-weight companion to JSON implementations on platforms such as PHP and JavaScript, so instead of defining its own expression language like XPath did, JSONPath delegated this to the expression language of the platform. While the languages in which JSONPath is used do have significant commonalities, over time this caused non-portability of JSONPath expressions between the ensuing platform-specific dialects.¶

The present specification aims to remove platform dependencies and serve as a common JSONPath specification that can be used across platforms. Obviously, this means that backwards compatibility could not always be achieved; a design principle of this specification is to go with a "consensus" between implementations even if it is rough, as long as that does not jeopardize the objective of obtaining a usable, stable JSON query language.¶

1.3. JSON Values

The JSON value a JSONPath query is applied to is, by definition, a valid JSON value. A JSON value is often constructed by parsing a JSON text.¶

The parsing of a JSON text into a JSON value and what happens if a JSON text does not represent valid JSON are not defined by this specification. Sections 4 and 8 of [RFC8259] identify specific situations that may conform to the grammar for JSON texts but are not interoperable uses of JSON, as they may cause unpredictable behavior. The present specification does not attempt to define predictable behavior for JSONPath queries in these situations.¶

Specifically, the "Semantics" subsections of Sections 2.5.1, 2.5.2, 2.5.5, and 2.6.2 describe behavior that becomes unpredictable when the JSON value for one of the objects under consideration was constructed out of JSON text that exhibits multiple members for a single object that share the same member name ("duplicate names", see Section 4 of [RFC8259]). Also, selecting a child by name (2.5.1) and comparing strings (Section "Comparisons" in Section 2.5.5) assume these strings are sequences of Unicode scalar values, becoming unpredictable if they aren't (Section 8.2 of [RFC8259]).¶

1.4. Overview of JSONPath Expressions

This section is informative.¶

A JSONPath expression is applied to a JSON value, the argument. The output is a nodelist.¶

A JSONPath expression consists of an identifier followed by a series of zero or more segments each of which contains one or more selectors.¶

$['store']['book'][0]['title']

$.store.book[0].title

$.store.book[?@.price < 10].title

1.5. JSONPath Examples

This section is informative. It provides examples of JSONPath expressions.¶

The examples are based on the simple JSON value shown in Figure 1, representing a bookstore (that also has a bicycle).¶

{ "store": {
    "book": [
      { "category": "reference",
        "author": "Nigel Rees",
        "title": "Sayings of the Century",
        "price": 8.95
      },
      { "category": "fiction",
        "author": "Evelyn Waugh",
        "title": "Sword of Honour",
        "price": 12.99
      },
      { "category": "fiction",
        "author": "Herman Melville",
        "title": "Moby Dick",
        "isbn": "0-553-21311-3",
        "price": 8.99
      },
      { "category": "fiction",
        "author": "J. R. R. Tolkien",
        "title": "The Lord of the Rings",
        "isbn": "0-395-19395-8",
        "price": 22.99
      }
    ],
    "bicycle": {
      "color": "red",
      "price": 399
    }
  }
}

Table 2 shows some JSONPath queries that might be applied to this example and their intended results.¶

2.1. Overview

A JSONPath expression is a string which, when applied to a JSON value, the argument, selects zero or more nodes of the argument and outputs these nodes as a nodelist.¶

A query MUST be encoded using UTF-8. The grammar for queries given in this document assumes that its UTF-8 form is first decoded into Unicode code points as described in [RFC3629]; implementation approaches that lead to an equivalent result are possible.¶

A string to be used as a JSONPath query needs to be well-formed and valid. A string is a well-formed JSONPath query if it conforms to the ABNF syntax in this document. A well-formed JSONPath query is valid if it also fulfills all semantic requirements posed by this document.¶

To be valid, integer numbers in the JSONPath query that are relevant to the JSONPath processing (e.g., index values and steps) MUST be within the range of exact values defined in I-JSON [RFC7493], namely within the interval [-(2⁵³)+1, (2⁵³)-1]).¶

To be valid, strings on the right-hand side of the =~ regex matching operator need to conform to [I-D.draft-ietf-jsonpath-iregexp].¶

The well-formedness and the validity of JSONPath queries are independent of the JSON value the query is applied to; no further errors relating to the well-formedness and the validity of a JSONPath query can be raised during application of the query to a value.¶

Obviously, an implementation can still fail when executing a JSONPath query, e.g., because of resource depletion, but this is not modeled in the present specification. However, the implementation MUST NOT silently malfunction. Specifically, if a valid JSONPath query is evaluated against a structured value whose size doesn't fit in the range of exact values, interfering with the correct interpretation of the query, the implementation MUST provide an indication of overflow.¶

(Readers familiar with the HTTP error model may be reminded of 400 type errors when pondering well-formedness and validity, while resource depletion and related errors are comparable to 500 type errors.)¶

2.2. Syntax

Syntactically, a JSONPath query consists of a root identifier ($), which stands for a nodelist that contains the root node of the argument, followed by a possibly empty sequence of segments.¶

json-path = root-identifier segments
segments  =  *(S (child-segment /
                  descendant-segment))

The syntax and semantics of each segment are defined below.¶

2.3. Semantics

In this specification, the semantics of a JSONPath query define the required results and do not prescribe the internal workings of an implementation.¶

The semantics are that a valid query is executed against a value, the argument, and produces a list of zero or more nodes of the value.¶

The query is a root identifier followed by a sequence of zero or more segments, each of which is applied to the result of the previous root identifier or segment and provides input to the next segment. These results and inputs take the form of a nodelist, i.e., a sequence of zero or more nodes.¶

Segments can be added to a query to drill further into the structure of the input value.¶

The nodelist resulting from the root identifier contains a single node, the argument. The nodelist resulting from the last segment is presented as the result of the query. Depending on the specific API, it might be presented as an array of the JSON values at the nodes, an array of Normalized Paths referencing the nodes, or both -- or some other representation as desired by the implementation. Note that an empty nodelist is a valid query result.¶

A segment operates on each of the nodes in its input nodelist in turn, and the resultant nodelists are concatenated to produce the result of the segment. A node may be selected more than once and appears that number of times in the nodelist. Duplicate nodes are not removed.¶

A syntactically valid segment MUST NOT produce errors when executing the query. This means that some operations that might be considered erroneous, such as indexing beyond the end of an array, simply result in fewer nodes being selected.¶

Consider this example. With the argument {"a":[{"b":0},{"b":1},{"c":2}]}, the query $.a[*].b selects the following list of nodes: 0, 1 (denoted here by their value).¶

The query consists of $ followed by three segments: .a, [*], and .b.¶

Firstly, $ produces a nodelist consisting of just the argument.¶

Next, .a selects from any object input node and selects the node of any member value of the input node corresponding to the member name "a". The result is again a list of one node: [{"b":0},{"b":1},{"c":2}].¶

Next, [*] selects from any array input node all its elements (for an object input node, it would select all its member values, but not the member names). The result is a list of three nodes: {"b":0}, {"b":1}, and {"c":2}.¶

Finally, .b selects from any object input node with a member name b and selects the node of the member value of the input node corresponding to that name. The result is a list containing 0, 1. This is the concatenation of three lists, two of length one containing 0, 1, respectively, and one of length zero.¶

As a consequence of this approach, if any of the segments produces an empty nodelist, then the whole query produces an empty nodelist.¶

If a query may produce a nodelist with more than one possible ordering, a particular implementation may also produce distinct orderings in successive runs of the query.¶

In what follows, the semantics of each segment are defined for each kind of input node.¶

2.4. Root Identifier

root-identifier  = "$"

{"k": "v"}

2.5. Selectors

Selectors appear only inside child segments (Section 2.6.1) and descendant segments (Section 2.6.2).¶

A selector produces a nodelist consisting of zero or more children of the input value.¶

There are various kinds of selectors which produce children of objects, children of arrays, or children of either objects or arrays.¶

selector =  ( name-selector  /
              index-selector /
              slice-selector /
              filter-selector
            )

The syntax and semantics of each kind of selector are defined below.¶

name-selector       = string-literal

string-literal      = %x22 *double-quoted %x22 /     ; "string"
                      %x27 *single-quoted %x27       ; 'string'

double-quoted       = unescaped /
                      %x27      /                    ; '
                      ESC %x22  /                    ; \"
                      ESC escapable

single-quoted       = unescaped /
                      %x22      /                    ; "
                      ESC %x27  /                    ; \'
                      ESC escapable

ESC                 = %x5C                           ; \  backslash

unescaped           = %x20-21 /                      ; s. RFC 8259
                      %x23-26 /                      ; omit "
                      %x28-5B /                      ; omit '
                      %x5D-10FFFF                    ; omit \

escapable           = ( %x62 / %x66 / %x6E / %x72 / %x74 /
                         ; \b \f \n \r \t
                         ; b / ;  BS backspace U+0008
                         ; t / ;  HT horizontal tab U+0009
                         ; n / ;  LF line feed U+000A
                         ; f / ;  FF form feed U+000C
                         ; r / ;  CR carriage return U+000D
                         "/" / ;  /  slash (solidus) U+002F
                         "\" / ; \ backslash (reverse solidus) U+005C
                         (%x75 hexchar) ;  uXXXX      U+XXXX
                      )

hexchar = non-surrogate / (high-surrogate "\" %x75 low-surrogate)
non-surrogate = ((DIGIT / "A"/"B"/"C" / "E"/"F") 3HEXDIG) /
                 ("D" %x30-37 2HEXDIG )
high-surrogate = "D" ("8"/"9"/"A"/"B") 2HEXDIG
low-surrogate = "D" ("C"/"D"/"E"/"F") 2HEXDIG

HEXDIG = DIGIT / "A" / "B" / "C" / "D" / "E" / "F"

{
  "o": {"j j": {"k.k": 3}},
  "'": {"@": 2}
}

wildcard = "*"

{
  "o": {"j": 1, "k": 2},
  "a": [5, 3]
}

index-selector = int                             ; decimal integer

int            = ["-"] ( "0" / (DIGIT1 *DIGIT) ) ; -  optional
DIGIT1         = %x31-39                         ; 1-9 non-zero digit

["a","b"]

slice-selector =  [start S] ":" S [end S] [":" [S step ]]

start          = int       ; included in selection
end            = int       ; not included in selection
step           = int       ; default: 1

B              =    %x20 / ; Space
                    %x09 / ; Horizontal tab
                    %x0A / ; Line feed or New line
                    %x0D   ; Carriage return
S              = *B        ; optional blank space
RS             = 1*B       ; required blank space

FUNCTION Normalize(i, len):
  IF i >= 0 THEN
    RETURN i
  ELSE
    RETURN len + i
  END IF

FUNCTION Bounds(start, end, step, len):
  n_start = Normalize(start, len)
  n_end = Normalize(end, len)

  IF step >= 0 THEN
    lower = MIN(MAX(n_start, 0), len)
    upper = MIN(MAX(n_end, 0), len)
  ELSE
    upper = MIN(MAX(n_start, -1), len-1)
    lower = MIN(MAX(n_end, -1), len-1)
  END IF

  RETURN (lower, upper)

IF step > 0 THEN

  i = lower
  WHILE i < upper:
    SELECT a(i)
    i = i + step
  END WHILE

ELSE if step < 0 THEN

  i = upper
  WHILE lower < i:
    SELECT a(i)
    i = i + step
  END WHILE

END IF

["a", "b", "c", "d", "e", "f", "g"]

filter-selector = "?" S boolean-expr

boolean-expr      = logical-or-expr
logical-or-expr   = logical-and-expr *(S "||" S logical-and-expr)
                      ; disjunction
                      ; binds less tightly than conjunction
logical-and-expr  = basic-expr *(S "&&" S basic-expr)
                      ; conjunction
                      ; binds more tightly than disjunction

basic-expr        = exist-expr /
                    paren-expr /
                    relation-expr
exist-expr        = [logical-not-op S] (rel-path / json-path)
                       ; path existence or non-existence
rel-path          = current-node-identifier segments
current-node-identifier = "@"

paren-expr        = [logical-not-op S] "(" S boolean-expr S ")"
                                      ; parenthesized expression
logical-not-op    = "!"               ; logical NOT operator

relation-expr = comp-expr /           ; comparison test
                regex-expr            ; regular expression test

comp-expr    = comparable S comp-op S comparable
comparable   = number / string-literal /        ; primitive ...
               true / false / null /            ; values only
               singular-path                    ; Singular Path value
comp-op      = "==" / "!=" /                    ; comparison ...
               "<"  / ">"  /                    ; operators
               "<=" / ">="

singular-path     = rel-singular-path / abs-singular-path
rel-singular-path = current-node-identifier singular-path-segments
abs-singular-path = root-identifier singular-path-segments
singular-path-segments = *(S (name-segment / index-segment))
name-segment      = "[" name-selector "]" / dot-member-name-shorthand
index-segment     = "[" index-selector "]"

number       = int [ frac ] [ exp ]                ; decimal number
frac         = "." 1*DIGIT                         ; decimal fraction
exp          = "e" [ "-" / "+" ] 1*DIGIT           ; decimal exponent
true         = %x74.72.75.65                       ; true
false        = %x66.61.6c.73.65                    ; false
null         = %x6e.75.6c.6c                       ; null

regex-expr   = (singular-path / string-literal) S regex-op S regex
regex-op     = "=~"                        ; regular expression match
regex        = string-literal              ; I-Regexp

{
  "obj": {"x": "y"},
  "arr": [2, 3]
}

{
  "a": [3, 5, 1, 2, 4, 6, {"b": "j"}, {"b": "k"}, {"b": {}}],
  "o": {"p": 1, "q": 2, "r": 3, "s": 5, "t": {"u": 6}},
  "e": "f"
}

2.6. Segments

Segments apply one or more selectors to an input value and concatenate the results into a single nodelist.¶

It turns out that the more segments there are in a query, the greater the depth in the input value of the nodes of the resultant nodelist:¶

• A query with N segments, where N >= 0, produces a nodelist consisting of nodes at depth in the input value of N or greater.¶
• A query with N segments, where N >= 0, all of which are child segments (Section 2.6.1), produces a nodelist consisting of nodes precisely at depth N in the input value.¶

The syntax and semantics of each segment are defined below.¶

child-segment             = (child-longhand /
                             dot-wildcard-shorthand /
                             dot-member-name-shorthand)

child-longhand            = "[" S selector 1*(S "," S selector) S "]"

dot-wildcard-shorthand    = "." wildcard

dot-member-name-shorthand = "." dot-member-name
dot-member-name           = name-first *name-char
name-first                = ALPHA /
                            "_"   /            ; _
                            %x80-10FFFF
                              ; any non-ASCII Unicode character
name-char                 = DIGIT / name-first

DIGIT                     =  %x30-39              ; 0-9
ALPHA                     =  %x41-5A / %x61-7A    ; A-Z / a-z

["a", "b", "c", "d", "e", "f", "g"]

descendant-segment               = (descendant-child /
                                    descendant-wildcard-shorthand /
                                    descendant-member-name-shorthand)
descendant-child                 = ".." child-segment

descendant-wildcard-shorthand    = ".." wildcard
descendant-member-name-shorthand = ".." dot-member-name

{
  "o": {"j": 1, "k": 2},
  "a": [5, 3, [{"j": 4}, {"k": 6}]]
}

2.7. Semantics of null

Note that JSON null is treated the same as any other JSON value: it is not taken to mean "undefined" or "missing".¶

{"a": null, "b": [null], "c": [{}], "null": 1}

2.8. Normalized Paths

A Normalized Path is a canonical representation of the identity of a node in a value. Specifically, a Normalized Path is a JSONPath query with restricted syntax (defined below), e.g., $['book'][3], which when applied to the value results in a nodelist consisting of just the node identified by the Normalized Path. Note that a Normalized Path represents the identity of a node in a specific value. There is precisely one Normalized Path identifying any particular node in a value.¶

A canonical representation of a nodelist is as a JSON arrays of strings, where the strings are Normalized Paths.¶

Normalized Paths provide a predictable format that simplifies testing and post-processing of nodelists, e.g., to remove duplicate nodes. Normalized Paths are used in this document as result paths in examples.¶

Normalized Paths use the canonical bracket notation, rather than dot notation.¶

Single quotes are used to delimit string member names. This reduces the number of characters that need escaping when Normalized Paths appear in double quote delimited strings, e.g., in JSON texts.¶

Certain characters are escaped, in one and only one way; all other characters are unescaped.¶

Note: Normalized Paths are Singular Paths, but not all Singular Paths are Normalized Paths. For example, $[-3] is a Singular Path, but is not a Normalized Path. The Normalized Path equivalent to $[-3] would have an index equal to the array length minus 3. (The array length must be at least 3 if $[-3] is to identify a node.)¶

normalized-path      = root-identifier *(normal-index-segment)
normal-index-segment = "[" normal-selector "]"
normal-selector      = normal-name-selector / normal-index-selector
normal-name-selector = %x27 *normal-single-quoted %x27 ; 'string'
normal-single-quoted = normal-unescaped /
                       ESC normal-escapable
normal-unescaped     = %x20-26 /                 ; omit control codes
                       %x28-5B /                 ; omit '
                       %x5D-10FFFF               ; omit \
normal-escapable     = ( %x62 / %x66 / %x6E / %x72 / %x74 /
                           ; \b \f \n \r \t
                           ; b /         ;  BS backspace U+0008
                           ; t /         ;  HT horizontal tab U+0009
                           ; n /         ;  LF line feed U+000A
                           ; f /         ;  FF form feed U+000C
                           ; r /         ;  CR carriage return U+000D
                         "'" /           ;  ' apostrophe U+0027
                         "\" / ; \ backslash (reverse solidus) U+005C
                         (%x75 normal-hexchar)
                                        ; certain values u00xx U+00XX
                        )
normal-hexchar       = "0" "0"
                       (
                          ("0" %x30-37) / ; "00"-"07"
                          ("0" %x62) / ; "0b" ; omit U+0008-U+000A
                          ("0" %x65-66) /
                            ; "0e"-"0f" ; omit U+000C-U+000D
                          ("1" normal-HEXDIG)
                        )
normal-HEXDIG        = DIGIT / %x61-66   ; "0"-"9", "a"-"f"
normal-index-selector = "0" / (DIGIT1 *DIGIT)
                          ; non-negative decimal integer

Since there can only be one Normalized Path identifying a given node, the syntax stipulates which characters are escaped and which are not. So the definition of normal-hexchar is designed for hex escaping of characters which are not straightforwardly-printable, for example U+000B LINE TABULATION, but for which no standard JSON escape, such as \n, is available.¶

3.1. Registration of Media Type application/jsonpath

IANA is requested to register the following media type [RFC6838]:¶

Type name:

application¶

Subtype name:

jsonpath¶

Required parameters:

N/A¶

Optional parameters:

N/A¶

Encoding considerations:

binary (UTF-8)¶

Security considerations:

See the Security Considerations section of RFCXXXX.¶

Interoperability considerations:

N/A¶

Published specification:

RFCXXXX¶

Applications that use this media type:

Applications that need to convey queries in JSON data¶

Fragment identifier considerations:

N/A¶

Additional information:

Deprecated alias names for this type:

N/A¶

Magic number(s):

N/A¶

File extension(s):

N/A¶

Macintosh file type code(s):

N/A¶

Person & email address to contact for further information: iesg@ietf.org¶

Intended usage:

COMMON¶

Restrictions on usage:

N/A¶

Author:

JSONPath WG¶

Change controller:

IESG¶

Provisional registration? (standards tree only):

no¶

4.1. Attack vectors on JSONPath Implementations

Historically, JSONPath has often been implemented by feeding parts of the query to an underlying programming language engine, e.g., JavaScript's eval() function. This approach is well known to lead to injection attacks and would require perfect input validation to prevent these attacks (see Section 12 of [RFC8259] for similar considerations for JSON itself). Instead, JSONPath implementations need to implement the entire syntax of the query without relying on the parsers of programming language engines.¶

Attacks on availability may attempt to trigger unusually expensive runtime performance exhibited by certain implementations in certain cases. (See Section 10 of [RFC8949] for issues in hash-table implementations, and Section 8 of [I-D.draft-ietf-jsonpath-iregexp] for performance issues in regular expression implementations.) Implementers need to be aware that good average performance is not sufficient as long as an attacker can choose to submit specially crafted JSONPath queries or arguments that trigger surprisingly high, possibly exponential, CPU usage or, for example via a naive recursive implementation of the descendant segment, stack overflow. Implementations need to have appropriate resource management to mitigate these attacks.¶

4.2. Attacks on Security Mechanisms that Employ JSONPath

Where JSONPath is used as a part of a security mechanism, attackers can attempt to provoke unexpected or unpredictable behavior, or take advantage of differences in behavior between JSONPath implementations.¶

Unexpected or unpredictable behavior can arise from an argument with certain constructs described as unpredictable by [RFC8259]. Predictable behavior can be expected, except in relation to the ordering of objects, for any argument conforming with [RFC7493].¶

Other attacks can target the behavior of underlying technologies such as UTF-8 (see Section 10 of [RFC3629]) and the Unicode character set.¶

A.1. JSONPath and XPath

JSONPath expressions apply to JSON values in the same way as XPath expressions are used in combination with an XML document. JSONPath uses $ to refer to the root node of the argument, similar to XPath's / at the front.¶

JSONPath expressions move further down the hierarchy using dot notation ($.store.book[0].title) or the bracket notation ($['store']['book'][0]['title']), a lightweight/limited, and a more heavyweight syntax replacing XPath's / within query expressions.¶

Both JSONPath and XPath use * for a wildcard. The descendant operators, starting with .., borrowed from [E4X], are similar to XPath's //. The array slicing construct [start:end:step] is unique to JSONPath, inspired by [SLICE] from ECMASCRIPT 4.¶

Filter expressions are supported via the syntax ?(<boolean expr>) as in¶

$.store.book[?(@.price < 10)].title

Table 17 extends Table 1 by providing a comparison with similar XPath concepts.¶

For further illustration, Table 18 shows some XPath expressions and their JSONPath equivalents.¶

XPath has a lot more functionality (location paths in unabbreviated syntax, operators and functions) than listed in this comparison. Moreover, there are significant differences in how the subscript operator works in XPath and JSONPath:¶

• Square brackets in XPath expressions always operate on the node set resulting from the previous path fragment. Indices always start at 1.¶
• With JSONPath, square brackets operate on the object or array addressed by the previous path fragment. Array indices always start at 0.¶