3 ms·
One of the reason to prefer JSON over XML is that you can reasonably parse an untrusted JSON using default configuration without getting yourself pwned. A lot o
by maple3142 4y ago
One of the reason to prefer JSON over XML is that you can reasonably parse an untrusted JSON using default configuration without getting yourself pwned. A lot of XML processing libraries still support external entities by default that you have to disable them manually: https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html https://cheatsheetseries.owasp.org/cheatsheets/XML_External_...
- Sohcahtoa82 4y ago> you can reasonably parse an untrusted JSON using default configuration without getting yourself pwned. If only this were true. https://medium.com/r3d-buck3t/insecure-deserialization-with-json-net-c70139af011a https://medium.com/r3d-buck3t/insecure-deserialization-with-...
- maple3142 4y agoI know that one, but I think JSON.NET is to blame for this because it decide to take `$type` and other fields and apply some reflection magic on it. It isn't really different from evaling a random json field in your own business code. A lot of sane json implementation also don't do this too, like `JSON.parse` `json.loads` `json.Unmarshal`... On the other way, XML External Entity is a part of XML standard, so any standard compliant XML implementation have to support it. This is why XXE attack applies to many languages.