How to deserialize json string with an extra "" - json

Question

I have input Json string that I am trying to deserialize
{
"ID":1,
"Details":{
"Product":""Boston,saline"",
"cost":150.0
}
}
or
{
"ID":1,
"Details":{
"Product":"Boston "Sample"",
"cost":150.0
}
}
When I try to use $JsonConvert.DeserializeObject<JObject>(input) it gives me error saying "After parsing a value an unexpected character was encountered" and this is expected. Is there a way we can deserialize this kind of strings?
Thanks!

Answer 1

Could you use .replace from native String method to replace all double double quotes with a single double quote.

Answer 2

You can’t.
Say a user is able to create a product named ", "x": "y. This will be represented as (incorrectly serialized to)
"Details": {
"Product": "", "x": "y",
"cost": 150.0
}
That is valid JSON, so there’s no syntactic way to detect that anything is wrong.
Even worse, what if an attacker creates a product named ", "cost": 1.0, "x": "y. This will be represented as (with some formatting applied)
"Details": {
"Product": "",
"cost": 1.0,
"x": "y",
"cost": 150.0
}
What will your deserializer do with that? Will it accept it? (Some will.) Will it use the first "cost" or the second "cost"—that is, will it allow an attacker to lower the cost? And would it be possible for an attacker to create a duplicate "cost" after the real one? And even if everything is currently okay when deserializing that string, will it continue to work after upgrading to a new version of the library?
As of 2017, Json.net accepts such JSON and uses the second duplicate value (see Json.net no longer throws in case of duplicate). But this behavior changed between versions 6 and 8. Will it change again?
The only real fix is to fix whatever is generating this JSON.

Answer 3

The stuff in your examples is not JSON;
that is why you are having problems parsing it with a JSON parser.
Consider fixing either how the data is stored or how it is read.
Option 1: Fix how it is stored.
It looks like the string value "blammy"
is actually stored in your DB as something like: \"blammy\".
This is zero percent correct.
The value that gets stored in your DB column should be blammy
(notice, no quotes).
Fix that problem.
Option 2: Fix how is is read
Something is reading the column value from your DB.
Change that thing to remove outer double quotes from string data.
Then,
the (incorrectly) stored value \"blammy\" would be
read (and fixed) to be blammy.
This will only work with example 1 in your question.
You will need to do something else if you are getting example 2.