Re: [Json] Fixing / removing the safe-for-eval() regex

Bjoern Hoehrmann <derhoermi@gmx.net> Tue, 12 March 2013 03:31 UTC

Return-Path: <derhoermi@gmx.net>
X-Original-To: json@ietfa.amsl.com
Delivered-To: json@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8302021F88B9 for <json@ietfa.amsl.com>; Mon, 11 Mar 2013 20:31:50 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.499
X-Spam-Level:
X-Spam-Status: No, score=-2.499 tagged_above=-999 required=5 tests=[AWL=0.100, BAYES_00=-2.599]
Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id PeYcUw9IiJgw for <json@ietfa.amsl.com>; Mon, 11 Mar 2013 20:31:49 -0700 (PDT)
Received: from mout.gmx.net (mout.gmx.net [212.227.17.21]) by ietfa.amsl.com (Postfix) with ESMTP id CE0A421F87E9 for <json@ietf.org>; Mon, 11 Mar 2013 20:31:40 -0700 (PDT)
Received: from mailout-de.gmx.net ([10.1.76.20]) by mrigmx.server.lan (mrigmx002) with ESMTP (Nemesis) id 0M2Jfm-1V4t7Q0Rkq-00s9c1 for <json@ietf.org>; Tue, 12 Mar 2013 04:31:40 +0100
Received: (qmail invoked by alias); 12 Mar 2013 03:31:39 -0000
Received: from p5B232A66.dip.t-dialin.net (EHLO netb.Speedport_W_700V) [91.35.42.102] by mail.gmx.net (mp020) with SMTP; 12 Mar 2013 04:31:39 +0100
X-Authenticated: #723575
X-Provags-ID: V01U2FsdGVkX1+pZ6dcdj6pf80VratbvcW6+GtoaZWVS0JLzZc8DR pXAL6kZgQhulJd
From: Bjoern Hoehrmann <derhoermi@gmx.net>
To: "Hill, Brad" <bhill@paypal-inc.com>
Date: Tue, 12 Mar 2013 04:31:40 +0100
Message-ID: <n58tj8tj4bp81v4fm8f49483l4l4tgkndf@hive.bjoern.hoehrmann.de>
References: <370C9BEB4DD6154FA963E2F79ADC6F2E2795A91E@DEN-EXDDA-S12.corp.ebay.com>
In-Reply-To: <370C9BEB4DD6154FA963E2F79ADC6F2E2795A91E@DEN-EXDDA-S12.corp.ebay.com>
X-Mailer: Forte Agent 3.3/32.846
MIME-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 8bit
X-Y-GMX-Trusted: 0
Cc: "json@ietf.org" <json@ietf.org>
Subject: Re: [Json] Fixing / removing the safe-for-eval() regex
X-BeenThere: json@ietf.org
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: "Discussion related to JavaScript Object Notation \(JSON\)." <json.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/json>, <mailto:json-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/json>
List-Post: <mailto:json@ietf.org>
List-Help: <mailto:json-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/json>, <mailto:json-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 12 Mar 2013 03:31:50 -0000

* Hill, Brad wrote:
>If a new WG is chartered to update 4627, fixing or removing the 
>safe-for-eval() regex should be on the charter.
>
>There are now several known ways to break out of this regex:
>
>http://www.thespanner.co.uk/2011/07/25/the-json-specification-is-now-wrong/
>http://blog.mindedsecurity.com/2011/08/ye-olde-crockford-json-regexp-is.html

This should have been filed as erratum back in 2011, and should be filed
as an erratum immediately.
-- 
Björn Höhrmann · mailto:bjoern@hoehrmann.de · http://bjoern.hoehrmann.de
Am Badedeich 7 · Telefon: +49(0)160/4415681 · http://www.bjoernsworld.de
25899 Dagebüll · PGP Pub. KeyID: 0xA4357E78 · http://www.websitedev.de/