Select JSON Nodes with Android JSONPath

Direct answer

RFC 9535 standardizes JSONPath as a query expression over a JSON value tree. A query begins at the root and selects zero or more nodes, producing a nodelist; depending on the evaluator API, callers may receive values, normalized paths, or both. That differs from JSON Pointer, which identifies one location, and from full-text search, which matches tokens in indexed text. Before adding a dependency, state why structural multi-selection is needed. For one fixed field, a direct typed lookup or JSON Pointer may be simpler and easier to audit. Pin an RFC 9535-conforming evaluator and version. Older JSONPath libraries can have different grammars, filter behavior, function extensions, ordering, and result serialization. The RFC separates query well-formedness/validity from evaluation against a particular document: invalid syntax is an error independent of document contents, while a valid expression can produce an empty nodelist. Do not turn an empty result into the whole document, infer field presence from an error, or silently fall back to another evaluator with different semantics. Use Normalized Paths or another stable node reference alongside each selected value when the application needs provenance. They can identify which source node produced a prompt or preview field, but that reference is scoped to a particular document structure and revision; it is not a permanent database key or permission. RFC 9535 preserves duplicate node selections rather than deduplicating them. A wildcard over an array follows its array order, but do not generalize that to every result list: results from a selector list concatenate in selector order, and a slice with a negative step can traverse in reverse. Object-child order is not guaranteed. Define consumer ordering separately and never rely on object wildcard traversal order. A JSONPath selector is not an access-control rule. A query can select more fields than intended, and RFC 9535 warns that crafted query arguments or expressions can consume unexpectedly high or even exponential CPU in a naive implementation. Build product paths from an allowlist of fields where possible. If query text is user- or model-controlled, restrict enabled syntax and functions, validate it with the pinned evaluator, bound document bytes/depth and query length, and cap selected nodes and evaluation work. If the chosen library exposes no way to bound pathological traversal, do not accept arbitrary queries on untrusted data. Keep the JSON document and the selected projection separate. Parse the source once with a bounded JSON parser, preserve its source identity/revision, run the approved path, and return both selected values and their locations. Validate selected data against the task schema before inserting it into a prompt; a path expression that selects a password, contact detail, or private note does not make that field appropriate to expose. Authorization and user consent remain application decisions. Never evaluate JSONPath text with a host-language eval function or transform path components into reflection calls. Define exact result behavior for empty, duplicate, and ambiguous output. An empty nodelist is a normal JSONPath result; handle it with a no-match state rather than silently widening the selector. A selected node whose value is JSON null is not the same as selecting no node: for `{"a":null}`, `$['a']` yields one node with value null while `$['b']` yields an empty nodelist. Preserve or remove duplicates only under a documented consumer rule. RFC singular queries return at most one node, not exactly one; a caller that needs one value must still assert result count equals one. When ordering matters, encode the intended selector order explicitly or sort by a schema-defined stable key. Build fixtures that expose evaluator semantics: an object with nested keys containing slash and tilde characters; a selected null field beside an absent field; arrays queried by wildcard, selector lists in a different order, and slices with negative steps; nested descendants, empty filters, duplicate selections, and objects with different member serialization orders. Record query text, evaluator package/version, source revision, selected normalized paths, result count, elapsed work budget, and rejection category. Compare against expected nodelists from the RFC examples and a pinned compliance suite where available. Do not publish speed or universal implementation-conformance claims without device records. This guide describes a source-selection contract, not an AI answer method. It does not establish that a JSON value is trustworthy, that the selected fields support a generated answer, or that Cove uses JSONPath. The source-of-truth record and current authorization must still be checked before display or export. A path result is a location in one evaluated document, not semantic retrieval, database authorization, or proof that an empty result means no private data exists.

A user-selected report contributes only approved fields to a prompt

An offline assistant can summarize a local JSON export containing a customer note, account token, status fields, and line items. The product needs two approved fields and one filtered list, but a broad descendant query selects the token too and duplicates a line-item node.

Decision

Pin an RFC 9535 evaluator, build or validate an allowlisted query, preserve normalized node paths and duplicates, then filter selected fields through the task policy before prompt construction.

Expected outcome

The assistant receives a reviewable projection tied to a source revision; an empty or duplicate nodelist is explicit and cannot expand access or become a guessed answer.

Evidence to collect

The claim becomes reviewable only when the following evidence is attached to the same artifact and test run:

• Pinned JSONPath/RFC version and parser
• Singular/plural and selector-order fixtures
• Empty, duplicate, null, and unauthorized-node outcomes

Task quality needs a versioned corpus and acceptance rules. Fluent sample output is not an accuracy result.

Implementation workflow

1. Choose a structural query contract. Decide whether direct typed lookup, JSON Pointer, or JSONPath multi-selection is required. Record the exact RFC 9535 implementation/version and the query features enabled; do not assume legacy library behavior matches the standard.
2. Bound and parse the source document. Set source byte, nesting, node, and parse-work limits. Preserve the immutable source or revision identity; parse errors and malformed values are distinct from a valid path that selects no nodes.
3. Constrain query construction and evaluation. Prefer fixed allowlisted paths. If caller input is accepted, validate it with the pinned evaluator, limit query size and functions, and bound traversal/result work. Never use eval or treat a path as authorization.
4. Return values with provenance. Capture selected values and normalized paths where supported. Distinguish a selected null node from no node, preserve duplicate selections, define selector/wildcard/slice ordering, and assert count == 1 when the caller requires one value; a singular query alone only guarantees at most one.
5. Filter for the task before prompt or export. Apply a separate field allowlist and current authorization check to every selected node. Test empty, duplicate, malformed, deeply nested, wildcard, and sensitive-field fixtures before using the projection.

Keep each transition observable. A failure should identify the stage, artifact, runtime, and recovery action without logging private user content.

Acceptance criteria

• The exact RFC 9535 evaluator/version and supported query subset are recorded; no undocumented legacy grammar is assumed.
• Invalid query, empty nodelist versus selected null, duplicate results, selector-list order, negative-step slices, unspecified object order, and exact-one cardinality have explicit outcomes.
• Evaluation limits and source-data limits are tested; query results and normalized paths retain source revision provenance.
• Path selection never substitutes for field authorization, source validation, user consent, or evidence supporting a model answer.

Decision table

Failure patterns to prevent

• Treating empty selection as parse failure
• Assuming selected duplicates are automatically removed
• Executing an action because a query returned a node

Also prevent silent fallback, unpinned artifacts, missing cancellation, and conclusions that combine unlike configurations. Store unsuccessful runs alongside successful ones.

Minimum reproducibility record

Release checklist

• ☐ The primary query is answered without an unsupported number.
• ☐ Every artifact and runtime is pinned.
• ☐ The representative task and failure policy are explicit.
• ☐ Lifecycle, cancellation, cleanup, and fallback are tested.
• ☐ User-content and network boundaries are documented.
• ☐ Result wording applies only to the recorded configuration.
• ☐ The page links to raw method or evidence when results are added.

Sources and related evidence

• Android privacy and security
• IETF — RFC 9535 JSONPath syntax, nodelists, and security
• IETF — RFC 8259 JSON value model
• Android API — JsonReader streaming JSON parser

Chinese deployment and troubleshooting content is organized in the .奇连 AI 端侧专题.

Frequently asked questions