Tag 27 for generic object (new Foo)

[nuclight]

Is it possible to add tag 27 handling to instantiate "any" object? That is, [0] is class name and then are arguments to constructor, eg. 27(["Foo", "bar", 1]) means new Foo("bar", 1)

And may be possibly to default toCbor to this tag, too... This would be great for inter-language communication.

[hildjj]

There was some reason it wouldn't work the last time I looked, but I don't remember why.

I was thinking that this needs to come out of a list of blessed classes, for security reasons. I'll pre-load that list with reasonable stuff from globalThis, and allow modification of the list.

[nuclight]

Ah, yes, security is different side, I've mainly meant the possibility for such dynamic construction at all, in TypeScript; as it is sad that such OOP-support is currently in just one (unpopular) CBOR library.

As for security... Author of tag 27 also defined tag 26 for non-generic but Perl-only objects, and there, protocol is as follows: first, class must exist at all, then, class must have FREEZE (to CBOR) and THAW (opposite direction) methods, like:

Example of a hypothetical My::DateTime representation using a unix timestamp:

   26(["My::DateTime", 12345678])

   d8 1a                             # tag(26)
      82                             # array(2)
         6c                          # text(12)
            4d793a3a4461746554696d65 # "My::DateTime"
         1a 00bc614e                 # unsigned(12345678)

Example of the corresponding FREEZE method:

   sub My::DateTime::FREEZE {
      my ($self, $model) = @_;

      $self->as_seconds
   }

Example of the corresponding THAW method:

   sub My::DateTime::THAW {
      my ($class, $model, $seconds) = @_;

      $class->new_from_seconds ($seconds)
   }

Apart from this, codec instance has forbid_objects setting exactly for security reasons. May be list of allowed classes should be additional protection.