Re: [Json] Fixing / removing the safe-for-eval() regex

Bjoern Hoehrmann <derhoermi@gmx.net> Sun, 28 April 2013 00:06 UTC

Return-Path: <derhoermi@gmx.net>
X-Original-To: json@ietfa.amsl.com
Delivered-To: json@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6E57521F9917 for <json@ietfa.amsl.com>; Sat, 27 Apr 2013 17:06:54 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -6.599
X-Spam-Level:
X-Spam-Status: No, score=-6.599 tagged_above=-999 required=5 tests=[AWL=-4.000, BAYES_00=-2.599]
Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id GJm4lda9VJqd for <json@ietfa.amsl.com>; Sat, 27 Apr 2013 17:06:53 -0700 (PDT)
Received: from mout.gmx.net (mout.gmx.net [212.227.15.19]) by ietfa.amsl.com (Postfix) with ESMTP id 6C8D721F9916 for <json@ietf.org>; Sat, 27 Apr 2013 17:06:52 -0700 (PDT)
Received: from mailout-de.gmx.net ([10.1.76.16]) by mrigmx.server.lan (mrigmx002) with ESMTP (Nemesis) id 0M1Cg2-1Ulhel2unQ-00tDor for <json@ietf.org>; Sun, 28 Apr 2013 02:06:51 +0200
Received: (qmail invoked by alias); 28 Apr 2013 00:06:51 -0000
Received: from p54B4E90F.dip0.t-ipconnect.de (EHLO netb.Speedport_W_700V) [84.180.233.15] by mail.gmx.net (mp016) with SMTP; 28 Apr 2013 02:06:51 +0200
X-Authenticated: #723575
X-Provags-ID: V01U2FsdGVkX1+cZSYZ9pac9bZeyKHC6p04gR4gRe0oRrUaC42JO7 ohMUdQCS3zY5i3
From: Bjoern Hoehrmann <derhoermi@gmx.net>
To: Bjoern Hoehrmann <derhoermi@gmx.net>
Date: Sun, 28 Apr 2013 02:06:54 +0200
Message-ID: <9kpon8th73ivv3ii83mgpthkfdu7oq40rj@hive.bjoern.hoehrmann.de>
References: <370C9BEB4DD6154FA963E2F79ADC6F2E2795A91E@DEN-EXDDA-S12.corp.ebay.com> <n58tj8tj4bp81v4fm8f49483l4l4tgkndf@hive.bjoern.hoehrmann.de>
In-Reply-To: <n58tj8tj4bp81v4fm8f49483l4l4tgkndf@hive.bjoern.hoehrmann.de>
X-Mailer: Forte Agent 3.3/32.846
MIME-Version: 1.0
Content-Type: text/plain; charset="ISO-8859-1"
Content-Transfer-Encoding: 8bit
X-Y-GMX-Trusted: 0
Cc: "Hill, Brad" <bhill@paypal-inc.com>, "json@ietf.org" <json@ietf.org>
Subject: Re: [Json] Fixing / removing the safe-for-eval() regex
X-BeenThere: json@ietf.org
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: "Discussion related to JavaScript Object Notation \(JSON\)." <json.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/json>, <mailto:json-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/json>
List-Post: <mailto:json@ietf.org>
List-Help: <mailto:json-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/json>, <mailto:json-request@ietf.org?subject=subscribe>
X-List-Received-Date: Sun, 28 Apr 2013 00:06:54 -0000

* Bjoern Hoehrmann wrote:
>* Hill, Brad wrote:
>>If a new WG is chartered to update 4627, fixing or removing the 
>>safe-for-eval() regex should be on the charter.
>>
>>There are now several known ways to break out of this regex:
>>
>>http://www.thespanner.co.uk/2011/07/25/the-json-specification-is-now-wrong/
>>http://blog.mindedsecurity.com/2011/08/ye-olde-crockford-json-regexp-is.html
>
>This should have been filed as erratum back in 2011, and should be filed
>as an erratum immediately.

I've filed http://www.rfc-editor.org/errata_search.php?rfc=4627&eid=3607
for the latter. I note that there is an error in the blog posting, with

  +{ "valueOf": self["location"], 
  "toString": []["join"], 
  0: "javascript:alert(1)", 
  length: 1 
  } 

you cannot bypass the validation code because `length` contains `g` and
`h`, and the validation code disallows that; but quoting `"length"` gets
around that, and I've independently confirmed this in Internet Explorer
9 with the code in the erratum.

The former does not seem to be a valid issue.
-- 
Björn Höhrmann · mailto:bjoern@hoehrmann.de · http://bjoern.hoehrmann.de
Am Badedeich 7 · Telefon: +49(0)160/4415681 · http://www.bjoernsworld.de
25899 Dagebüll · PGP Pub. KeyID: 0xA4357E78 · http://www.websitedev.de/