Re: [Json] Security Considerations

[Stefan Drees <[e-mail]>]

On 07.06.13 01:10, Douglas Crockford wrote:
> On 6/6/2013 4:04 PM, Paul Hoffman wrote:
>>
>> On Jun 6, 2013, at 12:17 PM, Douglas Crockford <[e-mail]>
>> wrote:
>>
>>> Proposal:
>>>
>>>    With any data format, it is important to encode correctly.  Care must
>>>    be taken when constructing JSON texts by concatenation.  For example:
>>>
>>>    account = 4627;
>>>    comment = "\",\"account\":262";   // provided by attacker
>>>    json_text = "(\"account\":" + account + ",\"comment\":\"" +
>>> comment + "\"}";
>> The example is language-specific and, due to the escaping, hard to read.
> Which specific language would you say it is? Confusion attacks are often
> hard to read. That is why they work. ...

I propose to keep the example, but remove the need for quoting by 
switching to single quotes where needed:

"""
account = 4627;
comment = '","account":262';  // provided by attacker
json_text = '("account":' + account + ',"comment":"' + comment + '"}';
"""

this is valid (Java|ECMA)Script, right and also much more readable, 
isn't it?

All the best,
Stefan.