Take care when using the vRealize Automation REST API guys. As of vRealize Automation v. 6.2.3 there’s a bug that, depending on what REST client library you use, will break your JSON data and be kind of hard to track down.

The issue

when using vRA REST API to get data as JSON, it’s possible that this data includes ASCII control characters. By JSON specification it’s not valid to include double quotes (0x22), backslashes (0x5C) or any control characters (0x00 till 0x1F and 0x7F) inside string literals.

Example

We try to get a list of resourceOperations. it’s possible that those operations are custom day 2 operations. Such operations are allowed to have a description field, which may include ASCII control characters, e.g. it may include a newline formed by CR+LF (0x0D0A).

An example request may look like this:

class="highlight">
1
HTTP GET /api/consumer/resources/{resourceId}/actions

The response (truncated) may look like this:

class="highlight">
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
{
   "links": [
   ],
   "content": [
      {
	      {
	         "@type": "ConsumerResourceOperation",
	         "name": "My custom action",
	         "description": "This is the action description

	including a newline control character.",
	         "iconId": "cad71fb0-d760-4abc-bc8c-f7014d0c455a",
	         "type": "ACTION",
	         "id": "cad71fb0-d760-4abc-bc8c-f7014d0c455a",
	         "extensionId": null,
	         "providerTypeId": "com.vmware.csp.core.designer.service",
	         "bindingId": "556a370e-81e4-480a-86ee-9557d12aab84",
	         "hasForm": "true",
	         "formScale": "BIG"
	      },
	  [...]
	  }
	  [...]
}

As you can see, the response is not valid JSON because it includes a newline character. If you try to convert it into a JSON object, most parsers (the JSON spec. compliant one) will fail. This is also true for the (yet unofficial) JSON parser included inside vRealize Orchestrator, e.g.

class="highlight">
1
2
3
4
5
6
var restClient = cafeHost.createRestClient(vCACCAFEServicesEnum.CATALOG_SERVICE);
var response = restClient.get("consumer/resources/"+ressource.getId()+"/actions");

var responseBodyAsString = response.getBodyAsString();  // works
var responseBodyAsJSON = response.getBodyAsJson();      // will fail with error "SyntaxError: String contains control character"
var jsonData = JSON.parse(responseBodyAsString);        // will fail with error "SyntaxError: String contains control character"

Implications

While this was tested for resourceOperations, it may be true for other JSON data returned by the vRealize Automation REST API.

Requested fix

Any generated JSON data from vRealize Automation should be checked for unsupported characters and, if any are found, those should be removed or escaped using the JSON escape sequences before any response is send. In addition a JSON linter should be included for the REST API unit tests in order to help identify such issues.

I already reported this issue to VMware and hope it gets fixed soon.