Home/ Questions/Q 139761
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-11T07:29:35+00:00

JSON allows you to retrieve data in multiple formats from an AJAX call. For

  • 0

JSON allows you to retrieve data in multiple formats from an AJAX call. For example:

$.get(sourceUrl, data, callBack, 'json');

could be used to get and parse JSON code from sourceUrl.

JSON is the simply JavaScript code used to describe data. This could be evaled by a JavaScript interpreter to get a data structure back.

It’s generally a bad idea to evaluate code from remote sources. I know the JSON spec doesn’t specifically allow for function declarations, but there’s no reason you couldn’t include one in code and have an unsafe and naive consumer compile/execute the code.

How does jQuery handle the parsing? Does it evaluate this code? What safeguards are in place to stop someone from hacking sourceUrl and distributing malicious code?

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. The last time I looked (late 2008) the JQuery functions get() getJSON() etc internally eval the JSon string and so are exposed to the same security issue as eval.

    Therefore it is a very good idea to use a parsing function that validates the JSON string to ensure it contains no dodgy non-JSON javascript code, before using eval() in any form.

    You can find such a function at https://github.com/douglascrockford/JSON-js/blob/master/json2.js.

    See JSON and Broswer Security for a good discussion of this area.

    In summary, using JQuery’s JSON functions without parsing the input JSON (using the above linked function or similar) is not 100% safe.

    NB: If this sort of parsing is still missing from getJSON (might have recently been added) it is even more important to understand this risk due to the cross domain capability, from the JQuery reference docs:

    As of jQuery 1.2, you can load JSON data located on another domain if you specify a JSONP callback, which can be done like so: ‘myurl?callback=?’. jQuery automatically replaces the ? with the correct method name to call, calling your specified callback.

    • 0