3 ms·
It seems that if the attacker controls the source URL, he could eval anything he wanted in any either case?
by bickfordb 13y ago
It seems that if the attacker controls the source URL, he could eval anything he wanted in any either case?
- kolodny 13y agoWhile that's true in this case, it's considered a bad practice to eval json to get a javascript object. Most browsers (all modern ones) have a JSON.parse method that will safely evaluate all json strings to js object. The really old browsers have libraries to accomplish this. It seems that this article hasn't been updated in a while by the very fact that the next section is called "JSON-in-script output" and not jsonp, keep in mind this article even has a reference to json.org on the bottom of that page which includes a library to do said function