Re: [Json] Security Considerations

[Stephan Beal <[e-mail]>]

On Thu, Jun 6, 2013 at 9:17 PM, Douglas Crockford <[e-mail]>wrote:

>    which some parsers MAY see as being the same as
>
>   {"comment":"","account":262}



That wording "may" not be valid/necessary, depending on how the debate on
the handling of multiple keys goes ;). If, for example, implementations are
required to fail on multiple keys then any other behaviour is non-compliant
and need not (necessarily) be specified by the spec, except perhaps as
"non-normative" info.


>    It is much wiser to use JSON generators, which are available in many
>    forms for most programming languages, to do the encoding, avoiding
>    the confusion hazard.
>

Some generators (streaming ones) can still create dupes.

   For example, JavaScript's eval() function is able parse JSON text,
>    but is can also parse programs.  If an attacker can inject code into
>    the JSON text (as we saw above), then it can compromise the system.
>    JSON parsers should always be used instead.
>

IMHO that all belongs well within the realm of Best Practice (perhaps a
Security Concerns sub-section).

-- 
----- stephan beal
http://wanderinghorse.net/home/stephan/
http://gplus.to/sgbeal