Re: [Json] Security Considerations

[Stefan Drees <[e-mail]>]

On 06.06.13 21:17, Douglas Crockford wrote:
> Proposal:
>
>     ...
>
>     JSON is so similar to some programming languages that the native
>     parsing ability of the language processors can be used to parse JSON
>     texts.  This should be avoided because the native parser will accept
>     code which is not JSON.
>
>     For example, JavaScript's eval() function is able parse JSON text,
>     but is can also parse programs.  If an attacker can inject code into
>     the JSON text (as we saw above), then it can compromise the system.
>     JSON parsers should always be used instead.

as JSON allows '{"\/":null}' this already forbids any native parsing 
ability of C like (or "based") languages including Python ;-)

I think these paragraphs are a very good change, but might ripen even 
more through discussions.

For me the main points of data interchange and in sequence are:

1. Do not parse any untrusted data without preconditioning

2. Do not excecute/eval untrusted data

and trust is sometimes hard to establish ...

As long as these two points stand out and are not burried inside sample 
language terms, I am happy with any re-phrasing.

Stefan.