Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How to safely escape JSON inside HTML SCRIPT elements

sirre.al

Post reply on HN
Print view View original

41–47 of 47 posts

Re: How to safely escape JSON inside HTML SCRIPT elements

#41

Post by Dylan16807 »

maxbond wrote: post #39

I would say avoid trying to understand arcane nuances better than the adversary. Assume they've simultaneously got more time on their hands and sat on the relevant standards committees. Adopt a strategy that's robust to having missed a small nuance in the standard or in the particular implementation by this or that browser. (That doesn't mean there isn't value in a blog post enumerating the edge cases, of course.) Ka…

To me, escaping And yeah use URL-safe base64 when you do use it. -_ with no padding.

Re: How to safely escape JSON inside HTML SCRIPT elements

#42

Post by maxbond »

Dylan16807 wrote: post #41
maxbond wrote: post #39

I would say avoid trying to understand arcane nuances better than the adversary. Assume they've simultaneously got more time on their hands and sat on the relevant standards committees. Adopt a strategy that's robust to having missed a small nuance in the standard or in the particular implementation by this or that browser. (That doesn't mean there isn't value in a blog post enumerating the edge cases, of course.) Ka…

To me, escaping And yeah use URL-safe base64 when you do use it. -_ with no padding.

Yeah, that's fair, and I did forget about `=`/padding when I discussed base64. This instance is a solved problem with a simple solution, blessed by the standards body.

The advantage of the base64 technique is that it provides fewer degrees of freedom, and so is more robust to unforseen vectors of attack. It's defensive programming. But it comes at a cost of memory/bandwidth.

Re: How to safely escape JSON inside HTML SCRIPT elements

#44

Post by chrismorgan »

> Imagine if script tags required HTML escaping:

There are two situations in which it does.

① XML syntax, which is absolutely still a thing:

  data:application/xhtml+xml,console.log( 1 > 0 && 0 < 1 )
② Inside an SVG element in HTML syntax:

  data:text/html,console.log( 1 > 0 && 0 < 1 )

Re: How to safely escape JSON inside HTML SCRIPT elements

#45

Post by pwdisswordfishz »

comex wrote: post #3

If you're evaluating JSON as JavaScript, you also need to make sure none of the objects have a key named "__proto__", or else you can end up with some strange results. (This is related to the 'prototype pollution' attack, although searching that phrase will mostly give you information about the more-dangerous variant where two objects are being merged together with some JS library. If __proto__ is just part of a lite…

Or you can use JSON.parse with a string literal on the client side. Which is, surprisingly, more performant than parsing at compile time.

https://www.youtube.com/watch?v=ff4fgQxPaO0

Re: How to safely escape JSON inside HTML SCRIPT elements

#47

Post by pwdisswordfishz »

TOGoS wrote: post #28
forty wrote: post #13

Earlier quoted context omitted.

What's wrong with CDATA? Do you have concrete examples when that would not work?

As per the 'special parsing rules for script tags', browsers don't actually treat it as what you'd expect it means. console.log(" "); Results in this being output to the console: Browsers don't do what you intend if you wrap the whole script in CDATA, either. They treat the " I tend to use them anyway, as sort of a HTML/XHTML polyglot thing, because deep in my heart I still think HTML should be valid XML: /* */ In su…

> deep in my heart I still think HTML should be valid XML

Never was, never will be. Just write XHTML instead.

Post reply on HN