JSON data format

[Jeff]

I'm writing my first json/ajax code and I'm having a hard time wrapping
my mind around security issues.

I'm thinking of a json response that would look like this:

{"data":[
{"name":"name1" ,"street":"stre et1","zip":["zip1","zip2"," zip3"]}
,{"name":"name2 ","street":"str eet2"}
],
"instructions": {"function_to_e xecute":"some_f unction"}
}

and would be processed like this:

ajax=eval('(' + AJAX.responseTe xt + ')');

Now, I've been reading up on json but I can't quite make any sense out
of what the problem is. Is it accessing data on the server, or only
accessing data on the browser?

Is this a problem because of third party ads or extras that may be on
the page?

At the moment I'm just sending color and formatting information but I
suppose I'll want to do more later

Jeff

[Jeremy J Starcher]

Re: JSON data format

On Thu, 21 Feb 2008 02:09:56 -0500, Jeff wrote:

ajax=eval('(' + AJAX.responseTe xt + ')');
>
Now, I've been reading up on json but I can't quite make any sense out
of what the problem is. Is it accessing data on the server, or only
accessing data on the browser?

The security issue:

AJAX.responseTe xt -can- contain executable code that eval will happily
run.

(For example, someone with the ability to modify a product description
could change the description to executable code that will look for a
customer filling out credit card information on a shopping card and
submit that data somewhere else.)

Some folks prefer to avoid eval entirely and decode JSON manually, while
others are content to check out the JSON response and reject it if they
find anything funky.

Check this out for an example of the second approach. To the best of my
knowledge, this is regarded as secure.

<URL: http://www.json.org/json2.js >