8 ms·

I feel really dense, but I don't understand why the example line is throwing an error. The article mentions line terminators, but it doesn't seem to contain any

I feel really dense, but I don't understand why the example line is throwing an error. The article mentions line terminators, but it doesn't seem to contain any, and I also don't understand why "owned" would be escaped the way the author says... it looks as though the interpreter is just rejecting the use of quotes around the key. But I'm sure I'm just missing something, so I'd be much obliged if someone could enlighten me.

tjohns 14y ago
The line terminator is there, it just doesn't render as anything visible. (It's inserted directly as a unicode character, rather than it's HTML-escaped equivalent, so you won't even see it if you view source!) However, if you take a hex dump of the page, it becomes quite apparent: https://gist.github.com/4393892 https://gist.github.com/4393892 Note: The file is UTF-8 encoded, so you'd be looking for E2 80 A8 instead of \u2028.
jfarmer 14y ago
There's an invisible-to-the eye unicode character in the string "owned," if you copy and paste the text from the website. JSON is fine with these characters, but JavaScript is not. For plain-jane JSON this is usually fine, since you're not just evaluating the JSON as JavaScript, but are running the returned data through a JSON parser. A properly-designed JSON parser will escape any JSON-valid-but-JavaScript-invalid characters. JSONP, however, works differently and will use use the JavaScript parser. Womp womp. The blog post also lists two other cases, although the first case -- parsing JSON using eval -- is both insecure and incorrect. I haven't seen people do that in ages and ages.
- powrtoch 14y ago
  That makes sense. I was confused because I was also getting the error when I typed the line into the interpreter by hand. The issue being that I forgot to assign it to a variable (facepalm). Thanks for the explanation.
- mhotchen 14y ago
  Just an fyi, jQuery's core JSON parser actually uses eval (well, new Function(), which is almost the same, but with scope protection). https://github.com/jquery/jquery/blob/master/src/core.js#L529 https://github.com/jquery/jquery/blob/master/src/core.js#L52...
  - troels 14y ago
    Looks like someone should send a pull request then.
    - jgeralnik 14y ago
      To be fair, it does escape characters and verify with a regex that the data is actually JSON before eval-ing it.

tjohns 14y ago

The line terminator is there, it just doesn't render as anything visible. (It's inserted directly as a unicode character, rather than it's HTML-escaped equivalent, so you won't even see it if you view source!) However, if you take a hex dump of the page, it becomes quite apparent: https://gist.github.com/4393892 https://gist.github.com/4393892 Note: The file is UTF-8 encoded, so you'd be looking for E2 80 A8 instead of \u2028.

jfarmer 14y ago

There's an invisible-to-the eye unicode character in the string "owned," if you copy and paste the text from the website. JSON is fine with these characters, but JavaScript is not. For plain-jane JSON this is usually fine, since you're not just evaluating the JSON as JavaScript, but are running the returned data through a JSON parser. A properly-designed JSON parser will escape any JSON-valid-but-JavaScript-invalid characters. JSONP, however, works differently and will use use the JavaScript parser. Womp womp. The blog post also lists two other cases, although the first case -- parsing JSON using eval -- is both insecure and incorrect. I haven't seen people do that in ages and ages.

powrtoch 14y ago
That makes sense. I was confused because I was also getting the error when I typed the line into the interpreter by hand. The issue being that I forgot to assign it to a variable (facepalm). Thanks for the explanation.
mhotchen 14y ago
Just an fyi, jQuery's core JSON parser actually uses eval (well, new Function(), which is almost the same, but with scope protection). https://github.com/jquery/jquery/blob/master/src/core.js#L529 https://github.com/jquery/jquery/blob/master/src/core.js#L52...
- troels 14y ago
  Looks like someone should send a pull request then.
  - jgeralnik 14y ago
    To be fair, it does escape characters and verify with a regex that the data is actually JSON before eval-ing it.