Subject: [Json] Fixing / removing the safe-for-eval() regex

From: "Hill, Brad" <[email-masked]>
Date: Mon, 11 Mar 2013 17:46:37 +0000

If a new WG is chartered to update 4627, fixing or removing the safe-for-eval() regex should be on the charter.

There are now several known ways to break out of this regex:

http://www.thespanner.co.uk/2011/07/25/the-json-specification-is-now-wrong/
http://blog.mindedsecurity.com/2011/08/ye-olde-crockford-json-regexp-is.html

Alternatively, we might simply remove the regex and suggest that only "native" JSON parsing be allowed.  We may or may not be at a point in the ecosystem where this facility is widely available and eval() is no longer a necessary expedient in any significant number of cases.

As this regex is widely-used, I would suggest it should be improved for use in some situations and recommended more strongly against, up to and including MUST NOT in a web browser environment where json.parse() is available and the global scope is cluttered with objects that allow code execution.

Brad Hill

---

From: Bjoern Hoehrmann <[email-masked]>
Date: Tue, 12 Mar 2013 04:31:40 +0100

* Hill, Brad wrote:
>If a new WG is chartered to update 4627, fixing or removing the 
>safe-for-eval() regex should be on the charter.
>

This should have been filed as erratum back in 2011, and should be filed
as an erratum immediately.
-- 
Björn Höhrmann · mailto:[email-masked] · http://bjoern.hoehrmann.de
Am Badedeich 7 · Telefon: +49(0)160/4415681 · http://www.bjoernsworld.de
25899 Dagebüll · PGP Pub. KeyID: 0xA4357E78 · http://www.websitedev.de/