3 ms·
I have never considered parsing to be equivalent to executing a VM. Does this mean that if you found the right gadgets in the implementation of JSON.parse you c
by infogulch 9y ago
I have never considered parsing to be equivalent to executing a VM. Does this mean that if you found the right gadgets in the implementation of JSON.parse you could attack a browser just with that?
- Xylakant 9y agoI'm not aware of an instance where browsers were attacked via that vector, but for example Ruby On Rails was vulnerable to attacks via the JSON Parser: https://www.exploit-db.com/exploits/24434/ https://www.exploit-db.com/exploits/24434/ (many other frameworks too, I'm just picking this one because I'm familiar with it)