Re: [apps-discuss] Guidance on RFC 4627 as reference

[James M Snell <[e-mail]>]

I believe the specific concern for JSON is that, in many environments --
especially browsers -- JSON is often parsed using the JavaScript eval
function, which allows for the execution of arbitrary JavaScript code.
While the JSON specification itself restricts the syntax to non-executable
data, a malicious party could intentionally construct an invalid-JSON
object such that arbitrary code is executed within the browser. This
particular concern is unique for JavaScript relative to other formats (XML,
HTML) and really ought be addressed within the security considerations of
rfc4627. Specifically, implementors need to be warned against passing
unvalidated JSON to the eval function.

On Thu, Sep 20, 2012 at 8:52 AM, Paul Hoffman <[e-mail]> wrote:

> [snip]
>
> > But more generally, while you can of course invent
> > uses for pretty much any format imagineable that require integrity (or
> > confidentiality) protection, there are formats which are designed for
> > destributing public information and which do not involve active or
> executable
> > content or pointers to other stuff. In such cases there really are no
> integrity
> > concerns worth talking about.
>
>
> Errr, right. Are you saying JSON involves active or executable content? Or
> pointers to other stuff? If so, I agree that those are security
> considerations. I'm not seeing it in the JSON definition, however. What am
> I missing?
>
> --Paul Hoffman
> _______________________________________________
> apps-discuss mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/apps-discuss
>