JSON data - parsed or "Eval'ed"

Question

From a security point of view, I can just do "eval" for incoming JSON data as a critical error. If you have data like below, you will have problems.

{ someData:((function() { alert("i'm in ur code hackin' ur page"); })()) } 

I wondered what the most popular Javascript libraries do. Is it manual analysis or just eval?

[change]

I'm not asking if I need to parse / parse - I was asking which methods some of the popular JavaScript libraries use (jQuery, Prototype, etc.)

Answer 1

Here is the official JavaScript official parser :

 // In the second stage, we run the text against regular expressions that look // for non-JSON patterns. We are especially concerned with '()' and 'new' // because they can cause invocation, and '=' because it can cause mutation. // But just to be safe, we want to reject all unexpected forms. // We split the second stage into 4 regexp operations in order to work around // crippling inefficiencies in IE and Safari regexp engines. First we // replace the JSON backslash pairs with '@' (a non-JSON character). Second, we // replace all simple value tokens with ']' characters. Third, we delete all // open brackets that follow a colon or comma or that begin the text. Finally, // we look to see that the remaining characters are only whitespace or ']' or // ',' or ':' or '{' or '}'. If that is so, then the text is safe for eval. if (/^[\],:{}\s]*$/. test(text.replace(/\\(?:["\\\/bfnrt]|u[0-9a-fA-F]{4})/g, '@'). replace(/"[^"\\\n\r]*"|true|false|null|-?\d+(?:\.\d*)?(?:[eE][+\-]?\d+)?/g, ']'). replace(/(?:^|:|,)(?:\s*\[)+/g, ''))) { // In the third stage we use the eval function to compile the text into a // JavaScript structure. The '{' operator is subject to a syntactic ambiguity // in JavaScript: it can begin a block or an object literal. We wrap the text // in parens to eliminate the ambiguity. j = eval('(' + text + ')'); ... 

Except for the built-in JSON parsing support found in modern browsers, this is all (library-based) protected by JSON Parsers (i.e., Regular Expression before eval ).

Protected libraries (in addition to the official json2 implementation)

The prototype isJSON .

Mootools JSON.decode function (again, via regex before eval ).

Unsecured Libraries :

dojo fromJson does not provide secure eval ing. Here is their entire implementation (minus the comments) :

 dojo.fromJson = function(json) { return eval("(" + json + ")"); } 

jQuery does not provide secure JSON eval 'ing, but see the official secureEvalJSON plugin (line 143).

Answer 2

You must take it apart! JSON is just a subset of JavaScript. But eval would appreciate any JavaScript code, not that particular subset as the JSON parser.

Answer 3

use evalJSON () instead?
As far as I know, this basically calls eval () after some sanitation checks.

Answer 4

From http://code.google.com/p/json-sans-eval/ :

Fast and safe JSON parser in JavaScript?

This JSON parser does not try to validate JSON, so you can return the result with syntactically invalid input, but it does not use eval, so it is deterministic and guaranteed not to modify any object other than its return value.

Are there several JSON parsers in JavaScript? at json.org. This implementation should be used whenever security is a problem (when JSON can from an untrusted source), speed is a problem, and incorrect JSON is not a concern.

This implementation

• Benefits Fast, Safe
• Minus Unverified

json_parse.js

• Pros Security
• disadvantages

json2.js

• Fast Benefits, Some Checks
• Cons Potentially Unsafe

json2.js is very fast, but potentially unsafe, because it calls eval to parse JSON, so an attacker might be able to deliver a weird JS that looks like JSON but executes arbitrary JavaScript.

If you need to use json2.js with unreliable data, make sure that you keep your version of json2.js up to date, so that you get the fixes since they are released.