ElMesa/json-security-considerations.md

## json-security-considerations.md

      
    Raw
  

              json-security-considerations.md
            
          
    JSON Security considerations

From: (RFC4627) The application/json Media Type for JavaScript Object Notation (JSON)

http://tools.ietf.org/html/rfc4627

Security considerations:

Generally there are security issues with scripting languages.  JSON
is a subset of JavaScript, but it is a safe subset that excludes
assignment and invocation.
A JSON text can be safely passed into JavaScript's eval() function
(which compiles and executes a string) if all the characters not
enclosed in strings are in the set of characters that form JSON
tokens.  This can be quickly determined in JavaScript with two
regular expressions and calls to the test and replace methods.
    var my_JSON_object = !(/[^,:{}\[\]0-9.\-+Eaeflnr-u \n\r\t]/.test(
           text.replace(/"(\\.|[^"\\])*"/g, ''))) &&
       eval('(' + text + ')');