Subject: [OAUTH-WG] JSON parsing in the browser (was: Proposal for single JSON response format)

From: Robert Sayre <[email-masked]>
Date: Sun, 27 Jun 2010 13:46:15 -0700

On Sun, Jun 13, 2010 at 11:20 AM, Evan Gilbert <[email-masked]> wrote:
>
>>
>> Can you explain the XSS hole from parsing a random JSON string?
>
> Naive processor calls:
> var href = document.location.href;
> var jsonBlob = href.substring(href.indexOf('#'), href.length)
> var userData  = eval(jsonBlob);
> This code would allow executing arbitrary code by sending a user a link,
> which could, for example, steal your cookies on a site.
> The fix is just a really complicated RegEx match

I don't agree with this assessment. The fix is to use json2.js from
json.org (which does indeed use a really complicated regex) if there
is no global JSON object available in the browser. A global JSON
object is available in IE8+, Firefox 3.5+, Safari 4.0.x+, and Chrome
and Opera (don't have the versions handy).

"Skate to where the puck is going, not to where it is." -- Wayne Gretzky

-- 

Robert Sayre

"I would have written a shorter letter, but I did not have the time."

---

From: Evan Gilbert <[email-masked]>
Date: Mon, 28 Jun 2010 10:53:47 -0700

On Sun, Jun 27, 2010 at 1:46 PM, Robert Sayre <[email-masked]> wrote:

> I don't agree with this assessment.

What specifically don't you agree with? I agree that the RegEx match or a
library will fix the security hole.

The problem is that the insecure behavior - "eval(json)" - will just work,
is obvious for developers to try, and non-obvious why this is a security
hole.

> The fix is to use json2.js from

---

From: Ian McKellar <[email-masked]>
Date: Tue, 29 Jun 2010 11:39:04 +1200

> is obvious for developers to try, and non-obvious why this is a security

I disagree that developers will blindly eval things to see if they can
parse. They're most likely to use a JSON library or the JSON
functionality of their favorite JS library. All of these will be safe.
If they're the kind of developer who will start evaling strings send
from the server then there's not much hope of their application being
secure, regardless of OAuth.

Ian

-- 
Ian McKellar  <http://ian.mckellar.org/>
[email-masked]: email | jabber | msn
ianloic: flickr | aim | yahoo | skype | linkedin | etc.