Subject: Re: [Json] Fixing / removing the safe-for-eval() regex

From: Bjoern Hoehrmann <[email-masked]>
Date: Sun, 28 Apr 2013 02:06:54 +0200

* Bjoern Hoehrmann wrote:
>* Hill, Brad wrote:
>>If a new WG is chartered to update 4627, fixing or removing the 
>>safe-for-eval() regex should be on the charter.
>>
>>There are now several known ways to break out of this regex:
>>
>>http://www.thespanner.co.uk/2011/07/25/the-json-specification-is-now-wrong/
>>http://blog.mindedsecurity.com/2011/08/ye-olde-crockford-json-regexp-is.html
>
>This should have been filed as erratum back in 2011, and should be filed
>as an erratum immediately.

I've filed http://www.rfc-editor.org/errata_search.php?rfc=4627&eid=3607
for the latter. I note that there is an error in the blog posting, with

  +{ "valueOf": self["location"], 
  "toString": []["join"], 
  0: "javascript:alert(1)", 
  length: 1 
  } 

you cannot bypass the validation code because `length` contains `g` and
`h`, and the validation code disallows that; but quoting `"length"` gets
around that, and I've independently confirmed this in Internet Explorer
9 with the code in the erratum.

The former does not seem to be a valid issue.
-- 
Björn Höhrmann · mailto:[email-masked] · http://bjoern.hoehrmann.de
Am Badedeich 7 · Telefon: +49(0)160/4415681 · http://www.bjoernsworld.de
25899 Dagebüll · PGP Pub. KeyID: 0xA4357E78 · http://www.websitedev.de/