Technical Insight

Handling Untrusted JSON Safely

JSON (JavaScript Object Notation) is quickly becoming the de-facto way to transport structured text data over the Web, a job also performed by XML. JSON is a limited subset of the object literal notation inherent to JavaScript, so you can think of JSON as just part of the JavaScript language. As a limited subset of JavaScript object notation, JSON objects can represent simple name-value pairs, as well as lists of values.

BUT, with JSON comes JavaScript and the potential for JavaScript Injection, the most critical type of Cross Site Scripting (XSS).

Just like XML, JSON data need to be parsed to be utilized in software. The two major locations within a Web application architecture where JSON needs to be parsed are in the browser of the client and in application code on the server.

Parsing JSON can be a dangerous procedure if the JSON text contains untrusted data. For example, if you parse untrusted JSON in a browser using the JavaScript “eval” function, and the untrusted JSON text itself contains JavaScript code, the code will execute during parse time.

From http://www.json.org/js.html :

“To convert a JSON text into an object, you can use the eval() function. eval() invokes the JavaScript compiler. Since JSON is a proper subset of JavaScript, the compiler will correctly parse the text and produce an object structure. The text must be wrapped in parentheses to avoid tripping on an ambiguity in JavaScript’s syntax.

var myObject = eval(‘(‘ + myJSONtext + ‘)’);

The eval function is very fast. However, it can compile and execute any JavaScript program, so there can be security issues.”

So the essential question is: How can programmers and applications parse untrusted JSON safely?

Parsing JSON safely, Client Side

The most common way to parse JSON safely in a modern browser is to utilize the JSON.parse method inherent to JavaScript. Here is a good reference that describes the state of JSON.parse browser support. And for legacy browsers that do not support native JSON parsing, there is always Douglas Crockford’s JSON parsing library for legacy browsers.

Parsing JSON in the browser is often the result of an asynchronous request returning JSON to the browser. Another technique that is becoming more common is to embed JSON directly in a Web page server side, and then to parse and render that JSON on the client side. The mechanism of embedding JSON safely in a Web page is described here: https://www.owasp.org/index.php/XSS_(Cross_Site_Scripting)_Prevention_Cheat_Sheet#RULE_.233.1_-_HTML_escape_JSON_values_in_an_HTML_context_and_read_the_data_with_JSON.parse

In this description, Step 1 shows safely embedded JSON on a Web page through HTML Entity Encoding:

<span style=”display:none” id=”init_data”>

<%= data.to_json %>  <– data is HTML escaped –>

</span>

Steps 2 and 3 includes decoding the JSON data and then parsing it safely:

<script>

// unescapes the content of the span

var jsonText = document.getElementById(‘init_data’).innerHTML;

// parse untrusted JSON safely

var initData = JSON.parse(jsonText);

</script>

Parsing JSON safely, Server Side

It’s important to use a formal JSON parser when handling untrusted JSON on the server side. For example, the Java Programing language can utilize the OWASP JSON Sanitizer for Java. The OWASP JSON Sanitizer project aspires to accomplish the following goals:

“Given JSON-like content, converts it to valid JSON.

This can be attached at either end of a data-pipeline to help satisfy Postel’s principle:

Be conservative in what you do; be liberal in what you accept from others.

Applied to JSON-like content from others, the OWASP JSON Sanitizer will produce well-formed JSON that should satisfy any parser you use.

Applied to your own output before you send, it will coerce minor mistakes in encoding and make it easier to embed your JSON in HTML and XML.”

The OWASP JSON Sanitizer project was created and is maintained by Mike Samuel, an esteemed member of the Google Application Security Team. For more information on the OWASP JSON Sanitizer, please visit the OWASP JSON Sanitizer Google Code page.

I hope this article helps you develop safer parsing of JSON in your applications. Please drop me a line if you have any questions at jim@owasp.org.

 

  • Pingback: Confluence: DevSpace()

  • Pingback: Confluence: Web Security Guide()

  • Optimus

    But what about if you need to update the data several times? Isn’t it much easier to do in javascript something like this:

    var json_object = JSON.parse(http_request.responseText);

    Isn’t it secure as well?

  • Madhusudhan

    Thanks for the valuable information, it helped my query to get resolved.