Re: [Json] Security Considerations

[Stefan Drees <[e-mail]>]

On 2013-06-07 17:58, Paul Hoffman wrote:
>
> On Jun 7, 2013, at 12:14 AM, Stefan Drees <[e-mail]> wrote:
>
>> On 07.06.13 01:10, Douglas Crockford wrote:
>>> On 6/6/2013 4:04 PM, Paul Hoffman wrote:
>>>>
>>>> On Jun 6, 2013, at 12:17 PM, Douglas Crockford <[e-mail]>
>>>> wrote:
>>>>
>>>>> Proposal:
>>>>>
>>>>>    With any data format, it is important to encode correctly.  Care must
>>>>>    be taken when constructing JSON texts by concatenation.  For example:
>>>>>
>>>>>    account = 4627;
>>>>>    comment = "\",\"account\":262";   // provided by attacker
>>>>>    json_text = "(\"account\":" + account + ",\"comment\":\"" +
>>>>> comment + "\"}";
>>>> The example is language-specific and, due to the escaping, hard to read.
>>> Which specific language would you say it is? Confusion attacks are often
>>> hard to read. That is why they work. ...
>>
>> I propose to keep the example, but remove the need for quoting by switching to single quotes where needed:
>>
>> """
>> account = 4627;
>> comment = '","account":262';  // provided by attacker
>> json_text = '("account":' + account + ',"comment":"' + comment + '"}';
>> """
>>
>> this is valid (Java|ECMA)Script, right and also much more readable, isn't it?
>
> I can live with this, but I think doing it in English wording is better.

Proposal in English wording:

replace
OLD(++):
"""
With any data format, it is important to encode correctly.  Care must
be taken when constructing JSON texts by concatenation.  For example:

account = 4627;
comment = '","account":262';  // provided by attacker
json_text = '("account":' + account + ',"comment":"' + comment + '"}';

"""

with:
NEW:
"""
With any data format, it is important to encode correctly.  Care must
be taken when constructing JSON texts by concatenation in part from 
untrusted data, this data may inject a mix of structural characters and 
quotes, that changes the structure of the resulting JSON text.
For example: When trying to compose an object like
{"account": 4627, "comment": "foo"} from user input data for "foo", the 
attacking user might instead inject ","account":262,"comment":"hacked so 
that the resulting naively concatenated JSON text would become:
{"account": 4627, "comment": "","account":262,"comment":"hacked"}


"""

What do you think?

All the best,
Stefan.