Re: [Json] Security considerations

I think it would be good to say something like "There are regular 
expressions floating around with the claims that they can pre-check a 
JSON text and make it safe to pass it to eval() and friends, but none of 
these are actually work."

I think it would be a bad idea to say something like "Here is a regular 
expression which almost works."

Regards,    Martin.

Off-topic:

I think that the regular expression engine in Ruby 1.9 (Oniguruma) comes 
with features that allow the creation of a Regexp object that would do 
the full job. That's because these regular expressions essentially are 
powered up to reach the level of context-free languages.

Of course, from a viewpoint of formal language theory, they don't 
deserve to be called regular expressions anymore, but then this applies 
to virtually all of the "regular expression" implementations in today's 
languages and libraries.

On 2013/10/07 13:09, Tim Bray wrote:
> What is the argument against including a conventional warning against a
> plausible-but-dangerous practice?  The only one I can think of is “everyone
> already knows that” which doesn’t seem very strong to me.
>
>
> On Sun, Oct 6, 2013 at 8:19 PM, Paul Hoffman<paul.hoffman@vpnc.org>  wrote:
>
>> On Oct 6, 2013, at 8:18 PM, Tim Bray<tbray@textuality.com>  wrote:
>>
>>> You mean will not cover might-make-you-safe regex, or will not warn of
>> the dangers of eval()?
>>
>> Correct.
>>
>> --Paul HOffman
>> _______________________________________________
>> json mailing list
>> json@ietf.org
>> https://www.ietf.org/mailman/listinfo/json
>>
>
>
>
> _______________________________________________
> json mailing list
> json@ietf.org
> https://www.ietf.org/mailman/listinfo/json