Cheap, structural checks over inbound data - a save imported from another device or
server (SaveSystem.importSlot), a news feed response (NewsClient), an external save
format (rpg.decodeMarshal) - run before any of it is parsed or handed to a game as
trusted state. Deliberately narrow: a size cap and a control-character check catch a
truncated, corrupted, or hostile payload cheaply, ahead of and distinct from validating
that a parsed value's own fields have the shape a game actually expects (validateSchema,
below), which is a separate, deeper pass over already-parsed data.
// the cheap structural pass, before JSON.parse ever sees the payload consttext = sanitizeInboundText(rawResponseText, { maxBytes:1_000_000 }); // equivalent to calling checkSize then checkNoControlCharacters by hand
// the deeper pass, once the payload is parsed constparsed = JSON.parse(text); validateSchema(parsed, { type:'object', fields: { id: { type:'string' }, score: { type:'number', min:0 } }, });
Cheap, structural checks over inbound data - a save imported from another device or server (
SaveSystem.importSlot), a news feed response (NewsClient), an external save format (rpg.decodeMarshal) - run before any of it is parsed or handed to a game as trusted state. Deliberately narrow: a size cap and a control-character check catch a truncated, corrupted, or hostile payload cheaply, ahead of and distinct from validating that a parsed value's own fields have the shape a game actually expects (validateSchema, below), which is a separate, deeper pass over already-parsed data.Example