4 ms·
Any de-serialization should be done via safe loaders. Using `require()` or `eval()` isn't something I'd do outside of a very narrow set of scenarios.
by bshacklett 3y ago
Any de-serialization should be done via safe loaders. Using `require()` or `eval()` isn't something I'd do outside of a very narrow set of scenarios.
- arwineap 3y agoThe json modules in the same languages doesn't support the madness and doesn't necessitate a safe loader It's possible someone could come along and write a json library that would support this, but somehow we have made it this far without it and that's a good thing The point is that yaml and xml both have side effects in the form of require and eval that json won't, and frequently people are unaware of this
- bshacklett 3y agoI feel I must still be misunderstanding something. OWASP has pages of resources which talk about the lack of safety of JSON: https://owasp.org/search/?searchString=json https://owasp.org/search/?searchString=json Perhaps yaml and xml have _more_ ways to inject behavior into an application, but I would still not consider JSON safe in any way. Why would JSON.parse() even exist if `require()` and `eval()` were safe to use?