3 ms·
The json modules in the same languages doesn't support the madness and doesn't necessitate a safe loader It's possible someone could come along and write a jso
by arwineap 3y ago
The json modules in the same languages doesn't support the madness and doesn't necessitate a safe loader
It's possible someone could come along and write a json library that would support this, but somehow we have made it this far without it and that's a good thing
The point is that yaml and xml both have side effects in the form of require and eval that json won't, and frequently people are unaware of this
- bshacklett 3y agoI feel I must still be misunderstanding something. OWASP has pages of resources which talk about the lack of safety of JSON: https://owasp.org/search/?searchString=json https://owasp.org/search/?searchString=json Perhaps yaml and xml have _more_ ways to inject behavior into an application, but I would still not consider JSON safe in any way. Why would JSON.parse() even exist if `require()` and `eval()` were safe to use?