2 ms·
> JSON is still the only secure by default one (if you ignore the two later updates, which made it insecure), And enough people put it into eval that several
by josefx 7y ago
> JSON is still the only secure by default one (if you ignore the two later updates, which made it insecure),
And enough people put it into eval that several companies started prepending while(1); to their JSON messages. Don't blindly trust user input no matter what format it comes in.
> JSON is by far the easiest to parse (small and secure, no references),
We all know its definition fits on a business card, which is the reason we have at least seven different specifications[1] on the details omitted from the card.
[1]http://seriot.ch/parsing_json.php http://seriot.ch/parsing_json.php
- minitech 7y ago> And enough people put it into eval that several companies started prepending while(1); to their JSON messages. while(1); existed to work around a browser vulnerability where the same-origin policy could be bypassed by including cross-origin JSON as a <script>. Nothing to do with eval.