Online Developer Tools a Backdoor to Security Threat

JOLT (JSON Object Language for Transformation) is a JSON transformation library used to restructure, modify, and manipulate JSON data in a declarative manner. It allows you to change JSON structures without writing complex parsing logic, making it ideal for API response transformations and data processing. 

Basic Operations in JOLT

JOLT provides several transformation operations, each serving a unique purpose:

1. Shift

• Moves data within JSON structures.
• Helps rename keys, change hierarchy, and reorganize data.

2. Modify-Default

• Adds default values to JSON keys if they are missing.
• Useful for enforcing expected fields.

3. Modify-Overwrite

• Updates or overwrites existing values in JSON.
• Useful for applying changes dynamically.

4. Remove

• Deletes specific keys or sections from the JSON.
• Helps in cleaning up unnecessary data.

5. Cardinality

• Converts single elements to arrays or vice versa.
• Helps in handling array structures dynamically.

6. Sort

• Sorts JSON keys into a specific order.
• Useful when a structured output is required.

Each operation is defined using a spec file, which outlines how the JSON should be transformed.

We shall mainly discuss shift operations while touching up the others so as not to deviate from the main focus. 

JOLT Shift Operation

The shift operation in JOLT is one of the most fundamental and powerful transformations. It allows you to restructure JSON data by moving keys, renaming fields, and altering the hierarchy of the JSON structure.

Key Features of Shift Operation

1. Reorganizing data – Moves fields to new locations in the JSON structure.
2. Renaming keys – Modifies existing field names.
3. Nested transformations – Can move data into deeper or shallower structures.
4. Dynamic mapping – Can extract and map values based on patterns.

For example, the input JSON below needs to be transformed.

// SOURCE / INPUT JSON 
{
    "user": {
        "name": "Alice",
        "age": 30
    }
}


// EXPECTED TARGET JSON 

{
    "profile": {
        "fullName": "Alice",
        "userAge": 30
    }
}

To achieve the following, we use the following specification.

[
    {
        "operation": "shift",
        "spec": {
            "user": {
                "name": "profile.fullName",
                "age": "profile.userAge"
            }
        }
    }
]

The below relation, therefore, explains the role of a Spec file:

Input JSON + Spec File (Transformation Logic declared in some JSON-based DSL ) -> Transformer  Engine -> Output JSON

JOLT Transformations  

The JOLT documentation provides a wide range of examples that describe the Spec File grammar. To test the above, we can visit https://jolt-demo.appspot.com/ and use its playground. 

One can use this to experiment with the JOLT specification and the different types of operations it offers. 

However, should you use it with real data and transformation logic? Let me help you decide on this. If you inspect the network traffic that triggers when the "Transform" button is clicked, you'd see this outbound HTTP request to the server:

curl 'https://jolt-demo.appspot.com/transform' \
  -H 'accept: */*' \
  -H 'accept-language: en-US,en;q=0.9,en-GB;q=0.8,bn;q=0.7' \
  -H 'content-type: application/x-www-form-urlencoded; charset=UTF-8' \
  -H 'origin: https://jolt-demo.appspot.com' \
  -H 'priority: u=1, i' \
  -H 'referer: https://jolt-demo.appspot.com/' \
  -H 'sec-ch-ua: "Chromium";v="136", "Google Chrome";v="136", "Not.A/Brand";v="99"' \
  -H 'sec-ch-ua-mobile: ?0' \
  -H 'sec-ch-ua-platform: "Windows"' \
  -H 'sec-fetch-dest: empty' \
  -H 'sec-fetch-mode: cors' \
  -H 'sec-fetch-site: same-origin' \
  -H 'user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36' \
  -H 'x-requested-with: XMLHttpRequest' \
  --data-raw 'input=%7B%0A++%22user%22%3A+%7B%0A++++%22name%22%3A+%22Alice%22%2C%0A++++%22age%22%3A+30%0A++%7D%0A%7D&spec=%5B%0A++%7B%0A++++%22operation%22%3A+%22shift%22%2C%0A++++%22spec%22%3A+%7B%0A++++++%22user%22%3A+%7B%0A++++++++%22name%22%3A+%22profile.fullName%22%2C%0A++++++++%22age%22%3A+%22profile.userAge%22%0A++++++%7D%0A++++%7D%0A++++%7D%0A%5D%0A&sort=false'

The transformation occurs on the server, and a normal user is neither aware of what happens to their data thereafter nor how it is purged, if at all. Sorry, but it should not be used where your data is sensitive. You might be using mocked, non-customer data, yet risking exposing your transformation logic is not worth the power of the utility. 

To search for an alternative, you need to have something that complies with your organization as well as the customer you work for. It should fit in the budget and licensing policy. Spending heavily on something that's extremely sophisticated will be overkill. It would be best if one could write one's own tool providing similar functionality and execute only on one's local machine. Thus, the safety of the data is ensured, and developers can use and delete their local data as needed. 

I'd come across a similar use case, and I wrote a simple Spring Web MVC application that served the same purpose. Please refer to the source code https://github.com/trainerpb/jolt-playground/tree/essential-tools. It's a minimally working project. This comprises not only a single utility but also many such utilities under the same umbrella, allowing them to be used locally. Developers' contributions to the betterment of this endeavour will benefit the entire developer community, especially when incidents of accidental data breaches are surfacing every day. 

This video is a quick walk-through of the utility suite.

Video