[Json] Security Considerations

[Douglas Crockford <[e-mail]>]

Proposal:

    With any data format, it is important to encode correctly.  Care must
    be taken when constructing JSON texts by concatenation.  For example:

    account = 4627;
    comment = "\",\"account\":262";   // provided by attacker
    json_text = "(\"account\":" + account + ",\"comment\":\"" + comment 
+ "\"}";

    The result will be

    {"account":4627,"comment":"","account":262}

    which some parsers MAY see as being the same as

    {"comment":"","account":262}

    This confusion allows an attacker to modify the account property or
    any other property.

    It is much wiser to use JSON generators, which are available in many
    forms for most programming languages, to do the encoding, avoiding
    the confusion hazard.

    JSON is so similar to some programming languages that the native
    parsing ability of the language processors can be used to parse JSON
    texts.  This should be avoided because the native parser will accept
    code which is not JSON.

    For example, JavaScript's eval() function is able parse JSON text,
    but is can also parse programs.  If an attacker can inject code into
    the JSON text (as we saw above), then it can compromise the system.
    JSON parsers should always be used instead.