Question

I want to build a multi tenent cloud app. My stack is javascript / json end-2-end: The user inputs data in the browser which jquery turns to json, sends to my node.js server, which in turn stores it as json in couchdb. When fetching data json goes the other way around. If the user injects something to this json is there anywhere in the above stack this json is actually evaludated? If yes I need to sanitize it. How robust is json sanitization? Or will a sandbox help? how robust is it?

This is a multi tenent environment and a lot of secret data of users and companies will be there.

Answer 1

Look on Caja or Node-validator

• Caja is implementation of Google Caja sanitizer
• Node-validator is a node validator/sanitizer, here express node-validator wrapper

Good luck