On a similar token, I'm so happy REST won over WSDL.
Why is JSON so popular? Developers want out of the syntax business
51–60 of 120 posts
Re: Why is JSON so popular? Developers want out of the syntax business
#52Earlier quoted context omitted.
eval() strikes me as a dangerous thing, security-wise.
How? I'm evaluating strings that are built with my javascript code or from my server code, not arbitrary user input from other users. Yes the user is able to enter parenthesis into a textbox, and those become part of the evaluated string, but I regex replace out everything but the actual parenthesis.
Yes, but the security of that part of your system could be pretty implicit, hence less than robust in the face of maintenance coding. The idea that "this is safe because everything but the parens are filtered out" won't necessarily jump out of the code at whoever maintains it.
If the code is structured to reveal this intention explicitly, then job well done.
(Note: It's not always a good idea to rest the future security of your system on a comment in the code!)
Re: Why is JSON so popular? Developers want out of the syntax business
#53Earlier quoted context omitted.
Please don't write "begs the question" when you mean "raises the question". http://begthequestion.info/
But if we know what he meant why does this matter? Language exists to convey meaning, and I think we all understood what he meant, so I don't see the problem here.
"I know this sounds like a semantic quibble, but words mean things." -- unknown
Re: Why is JSON so popular? Developers want out of the syntax business
#54Earlier quoted context omitted.
Please don't write "begs the question" when you mean "raises the question". http://begthequestion.info/
But if we know what he meant why does this matter? Language exists to convey meaning, and I think we all understood what he meant, so I don't see the problem here.
The problem lies in dilution: if people recognize a new meaning in an old phrase, it becomes more difficult to convey the old meaning. (Because you can't use that phrase any more.)
There is also the case where you thought you conveyed the new meaning, while it hasn't caught on yet (meaning, you made a mistake). So, better stay safe and stick to the old meaning while we can.
Re: Why is JSON so popular? Developers want out of the syntax business
#55It's easy, it works.
Re: Why is JSON so popular? Developers want out of the syntax business
#56Isn't it dangerous to eval()? Suppose someone put some malicious code in the JSON data?
The question to ask is: is the JSON coming from a trusted source (e.g. generated by your server and you can reasonably sure that you have no funny XSS holes)? If the answer is yes, eval()-ing JSON is perfectly safe. If the answer no, you need to parse it without the help of the JS interpreter.
Re: Why is JSON so popular? Developers want out of the syntax business
#57Earlier quoted context omitted.
eval() strikes me as a dangerous thing, security-wise.
How? I'm evaluating strings that are built with my javascript code or from my server code, not arbitrary user input from other users. Yes the user is able to enter parenthesis into a textbox, and those become part of the evaluated string, but I regex replace out everything but the actual parenthesis.
Rather than "regex replace out" problematic elements, you should immediately toss the data back to the user for correction. Trying to "correct" a potential hacker's string is often a losing proposition.
Re: Why is JSON so popular? Developers want out of the syntax business
#58Earlier quoted context omitted.
I'm not sure what you think your JSON parser is doing.
Come on. Any one of us could write a JSON parser in a page of code. An XML parser is significantly more work due to the overcomplexness of XML. Both to write, and for the CPU to run. And it's larger. In fact I'm struggling to think of something XML has that is good. (And please no one respond with "it's extensible" or I may explode). An XML parser has to track open tag names, with JSON it doesn't matter. XML has all…
You know, I know we're just geeking out here so please don't read too much into me taking the devil's advocate position, but: yes, XML is harder to parse, but the underlying data that gets encoded in JSON and XML isn't substantially different.
In both cases --- and let's take the C implementation case --- you're still building a poorly specified buggy implementation of Tcl to actually hold the data and answer questions about it.
That's the point I'm trying to make.
Re: Why is JSON so popular? Developers want out of the syntax business
#59Re: Why is JSON so popular? Developers want out of the syntax business
#60Earlier quoted context omitted.
Every security assessor's favorite answer to a threat: "but I regex out everything unsafe".
How is building an intermediate portion of a nested logical statement, using eval() dangerous? Here is the regex for what I allow (only '[' & ']'): value.replace(/[^(]/g, '').replace(/\(/g, '[') value.replace(/[^)]/g, '').replace(/\)/g, '],') I guess the point you all are trying to make is that some javascript text could have been maliciously inserted into the page somehow, and accidentally get eval'd simply because…
If you are confident about charsets and you whitelist down to known-good characters ([A-Za-z0-9_ \t]) I have nothing snarky to say about the design. Otherwise, try reading this very short thread:
http://www.webappsec.org/lists/websecurity/archive/2010-03/m...
(It's not exactly your problem but you'll get the flavor.)