4 ms·
> I mean, it's probably fine if you're only ever getting your data from JSON.parse(). So 90% of use cases?
by Dylan16807 1y ago
> I mean, it's probably fine if you're only ever getting your data from JSON.parse().
So 90% of use cases?
- rafram 1y agoSure, and then only 10% of your use cases contain easily exploitable vulnerabilities.
- Dylan16807 1y agoYou use a different function than Validate_Parsed_JSON in those cases. But most typescript programs are only going to need JSON-compatible input. Maybe some XML but that's also going to have similar formulaic output from your parser. If something can directly hand you a maliciously built data structure, you're probably designing your system wrong. Are you running untrusted javascript in the same interpreter? That's a very hard problem that should be avoided if at all possible. Basically, only working on JSON.parse is something to document but it's not at all a weird restriction, or a reason to balk at putting it into production.