What are “top level JSON arrays” and why are they a security risk?

by

This is because a few years ago Jeremiah Grossman found a very interesting vulnerability that affects gmail. Some people have addressed this vulnerabilty by using an unparseable cruft (Mr bobince’s technical description on this page is fantastic.)

The reason why Microsoft is talking about this is because they haven’t patched their browser (yet). (Edit: Recent versions of Edge and IE 10/11 have addressed this issue.) Mozilla considers this to be a vulnerability in the json specification and therefore they patched it in Firefox 3. For the record I completely agree with Mozilla, and its unfortunate but each web app developer is going to have to defend them selves against this very obscure vulnerability.

More Related Contents:

  1. Why does Google prepend while(1); to their JSON responses?
  2. Is JSON Hijacking still an issue in modern browsers?
  3. Why do people put code like “throw 1; ” and “for(;;);” in front of json responses? [duplicate]
  4. Cross-site AJAX requests
  5. JSON security best practices?
  6. How to prevent direct access to my JSON service?
  7. Why does Google prepend while(1); to their JSON responses?
  8. Alternatives to JavaScript eval() for parsing JSON
  9. What makes an input vulnerable to XSS?
  10. What is the difference between JSON and Object Literal Notation?
  11. What is the “right” JSON date format?
  12. JavaScript: client-side vs. server-side validation
  13. Handle response – SyntaxError: Unexpected end of input when using mode: ‘no-cors’
  14. Can JavaScript connect with MySQL?
  15. How does Content Security Policy (CSP) work?
  16. Using number as “index” (JSON)
  17. multiple, sequential fetch() Promise
  18. How to escape a JSON string to have it in a URL?
  19. How to make a jsonp request
  20. Is there any native function to convert json to url parameters?
  21. How to deterministically verify that a JSON object hasn’t been modified?
  22. Writing a json object to a text file in javascript
  23. Returning JSON array from a Django view to a template
  24. Get JSON in a Chrome extension
  25. Multiple arguments vs. options object
  26. CSRF protection with CORS Origin header vs. CSRF token
  27. Selecting a JSON object with a colon in the key
  28. JSON to string variable dump
  29. How to make javascript fetch synchronous?
  30. Exploiting JavaScript’s eval() method

Leave a Comment