3 ms·
> Far as I know JSON broken as it is does do that. JSON in scripting languages does "as well" as Java's java.io.ObjectInputStream/java.io.ObjectOutputStream an
by ElectricalUnion 4y ago
> Far as I know JSON broken as it is does do that.
JSON in scripting languages does "as well" as Java's java.io.ObjectInputStream/java.io.ObjectOutputStream and dontnet's System.Runtime.Serialization.XmlObjectSerializer.
aka: will explode in your face in spetacular fashion [causing security vulnerabilities or denial of service in the way] unless you take special care to only use explicit safe serializable objects, and you handle corner cases correctly (for example, Javascript `__proto__` naive deserialization).