Subject: [Json] JSON in Web Pages. Was: Go JSON parser ignores the case of member names
From: Anders Rundgren <[email-masked]>
To: "Manger, James" <[email-masked]>, John Cowan <[email-masked]>, Rob Sayre <[email-masked]>
Cc: "[email-masked]" <[email-masked]>
Date: Thu, 10 Mar 2016 11:13:40 +0100
List-Id: "JavaScript Object Notation \(JSON\) WG mailing list" <json.ietf.org>

On 2016-03-10 05:55, Manger, James wrote:

> P.S. Another interesting feature of the standard JSON package in Go is that it ALWAYS escapes
> "<" as "\u003c" - as a safety feature, in case the JSON is used within HTML.

Whow James, you are a true genius for finding difficult spots!

My JSON tools have be upgraded to support JSON-serializable JavaScript objects
intended for usage in Web pages.  That's great but (of course...) I had overlooked
the case you mentioned:

<html...>

<script>

var jsonData = {
   trouble: "</script>"
};

FAIL!

That is, you really have to do as Go which fortunately have no practical implications
since an ES6 compatible serializer will anyway produce the right (normalized) result
during signature verification.  Sometimes you need a little bit of luck as well...

Anders