7 ms·

Trailing commas would make the problem worse! If you allow trailing commas then you would break json parsing in all old version of IE. The unicode line ending

Trailing commas would make the problem worse! If you allow trailing commas then you would break json parsing in all old version of IE. The unicode line ending problem is more subtle. I have seen people write code like (mix javascript and some templating): <script> var prefs = <%= user_prefs.to_spec_conforming_json() %>; ... The above code looks okay, but if the json is just spec conforming, then you are exposed to a potential XSS attack. Most people that write json encoders are aware of the problem, but why publish a a spec that can potentially create serious security problems?

ante_annum 13y ago
> you would break json parsing in all old version of IE Why do people still care about old versions of IE?
- windsurfer 13y ago
  They don't, it's just convenient to make their point. Pretty much any new technology isn't directly compatible with old technology.
- jcampbell1 13y ago
  IE10, IE11 in non-standards mode also don't accept trailing commas. I don't care if you accept trailing commas, but dear god, never emit them.
- drhayes9 13y ago
  ~22% of China still uses IE6: http://www.ie6countdown.com/ http://www.ie6countdown.com/ Developing nations have a tendency to not use the latest and greatest. If reaching them is important for you/your product then you have to keep tracking this stuff.
  - zanny 13y ago
    > Developing nations have a tendency to not use the latest and greatest. Attention developing nations: Chromium and Firefox are completely foss. No excuse, unless you don't have an internet connection. In which case, what do you need a web browser for?
    - jwdunne 13y ago
      I'm not sure about this but a lot of software might have been written specifically for IE6 and IE6 only, which might not translate well to Chrome/Firefox, and could cost businesses a lot of money, more money than they deem its worth. There could be ActiveX controls and such which can't be ported to Chrome/Firefox without money. This is based on my experience at UPS which used a single machine using IE6 and some form of web app to control start up and shut down procedures, or something to that effect. It had no Internet connection, only LAN I believe. I did ask myself this question too and it does seem peculiar. After some thought, my only guess is the above!
      - jlgreco 13y ago
        Don't they have another browser around for dealing with the rest of the world though? It's not like many modern sites are going to render correctly on IE6 these days...
        eropple 13y ago
        But all their apps work with IE6, and who cares about people trying to view Facebook while working?
        jlgreco 13y ago
        If they are off in their own totally isolated little IE6 only world, I don't get why we care about them then.
        eropple 13y ago
        Because their workers do go view Facebook. If that's a market you need to target, you need to make it work with IE6. (There's also the whole "they get infected with everything under the sun and make the rest of us deal with them", but that's not a visual issue.)
      - erichurkman 13y ago
  - AYBABTME 13y ago
    And if the internet stops working for them because they use IE6, will they somehow manage to upgrade?
masklinn 13y ago
> If you allow trailing commas then you would break json parsing in all old version of IE. No, you would break the evaluation of json as javascript in old versions of IE. Use a real parser already.
- jcampbell1 13y ago
  I do use a real parser, but it is not possible for JSON-P.
  - jonny_eh 13y ago
    Don't use JSONP.
    - jcampbell1 13y ago
      I suppose you have a better way to do cross-platform cross-domain APIs? Enlighten us. Facebook and Google use this method, and I assume it is because there isn't a better way.
      - bdisraeli 13y ago
        You can use CORS [1] on browsers that support it. [2] You really should use it if at all possible given your application's constraints, so you don't have to abuse GET requests and can use a JSON parser. [1] http://en.m.wikipedia.org/wiki/Cross-origin_resource_sharing http://en.m.wikipedia.org/wiki/Cross-origin_resource_sharing [2] http://caniuse.com/cors http://caniuse.com/cors
        tel 13y ago
        Cross platform?
        enko 13y ago
        Unfortunately CORS is not really doable if you have to support IE and need non-cookie authentication, as my company recently discovered to our sorrow. No custom headers, so goodbye to your X-Auth-Token. That has only been fixed in IE10.

ante_annum 13y ago

> you would break json parsing in all old version of IE Why do people still care about old versions of IE?

windsurfer 13y ago
They don't, it's just convenient to make their point. Pretty much any new technology isn't directly compatible with old technology.
jcampbell1 13y ago
IE10, IE11 in non-standards mode also don't accept trailing commas. I don't care if you accept trailing commas, but dear god, never emit them.
drhayes9 13y ago
~22% of China still uses IE6: http://www.ie6countdown.com/ http://www.ie6countdown.com/ Developing nations have a tendency to not use the latest and greatest. If reaching them is important for you/your product then you have to keep tracking this stuff.
- zanny 13y ago
  > Developing nations have a tendency to not use the latest and greatest. Attention developing nations: Chromium and Firefox are completely foss. No excuse, unless you don't have an internet connection. In which case, what do you need a web browser for?
  - jwdunne 13y ago
    I'm not sure about this but a lot of software might have been written specifically for IE6 and IE6 only, which might not translate well to Chrome/Firefox, and could cost businesses a lot of money, more money than they deem its worth. There could be ActiveX controls and such which can't be ported to Chrome/Firefox without money. This is based on my experience at UPS which used a single machine using IE6 and some form of web app to control start up and shut down procedures, or something to that effect. It had no Internet connection, only LAN I believe. I did ask myself this question too and it does seem peculiar. After some thought, my only guess is the above!
    - jlgreco 13y ago
      Don't they have another browser around for dealing with the rest of the world though? It's not like many modern sites are going to render correctly on IE6 these days...
      - eropple 13y ago
        But all their apps work with IE6, and who cares about people trying to view Facebook while working?
        jlgreco 13y ago
        If they are off in their own totally isolated little IE6 only world, I don't get why we care about them then.
        eropple 13y ago
        Because their workers do go view Facebook. If that's a market you need to target, you need to make it work with IE6. (There's also the whole "they get infected with everything under the sun and make the rest of us deal with them", but that's not a visual issue.)
    - erichurkman 13y ago
- AYBABTME 13y ago
  And if the internet stops working for them because they use IE6, will they somehow manage to upgrade?

masklinn 13y ago

> If you allow trailing commas then you would break json parsing in all old version of IE. No, you would break the evaluation of json as javascript in old versions of IE. Use a real parser already.

jcampbell1 13y ago
I do use a real parser, but it is not possible for JSON-P.
- jonny_eh 13y ago
  Don't use JSONP.
  - jcampbell1 13y ago
    I suppose you have a better way to do cross-platform cross-domain APIs? Enlighten us. Facebook and Google use this method, and I assume it is because there isn't a better way.
    - bdisraeli 13y ago
      You can use CORS [1] on browsers that support it. [2] You really should use it if at all possible given your application's constraints, so you don't have to abuse GET requests and can use a JSON parser. [1] http://en.m.wikipedia.org/wiki/Cross-origin_resource_sharing http://en.m.wikipedia.org/wiki/Cross-origin_resource_sharing [2] http://caniuse.com/cors http://caniuse.com/cors
      - tel 13y ago
        Cross platform?
      - enko 13y ago
        Unfortunately CORS is not really doable if you have to support IE and need non-cookie authentication, as my company recently discovered to our sorrow. No custom headers, so goodbye to your X-Auth-Token. That has only been fixed in IE10.