Re: [Json] Security considerations

On Sun, Oct 6, 2013 at 12:53 PM, John Levine <johnl@taugh.com> wrote:

> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> >> It dawns on me that the #1 security consideration every web programmer
> >learns, when using JSON, is “You could parse it with eval() but DON’T DO
> >THAT”. So should we include that in the -bis Security Considerations
> >section?
>
> I would be more concrete and note that a string that purports
> to be JSON could in fact be anything, so parsers should treat
> them with due scepticism.
>

+1.

>
> I suppose it wouldn't hurt to spell things out for the low-clue,
> and note that although it is possible to turn a JSON string into
> an internal reputation by evaluating it as Java(Ecma, etc.)script,
> that is exceedingly risky unless the string has been verified to
> be valid JSON.
>
> R's,
> John
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v2.0.21 (FreeBSD)
>
> iEYEARECAAYFAlJRlYsACgkQkEiFRdeC/kUpHgCfTAck4oWuM2dZlm0D2Xrbdvzk
> AzEAn1wGCFV2dBiqpoOmPmM9VDYpTdGq
> =hdOH
> -----END PGP SIGNATURE-----
>
> _______________________________________________
> json mailing list
> json@ietf.org
> https://www.ietf.org/mailman/listinfo/json
>
>

-- 
Matthew P. C. Morley