Is it safe to allow untrusted field names in JSON?

Question

When forming a JSON data structure, are there any security risks with allowing the field names to be chosen by an attacker? You can assume they'll be quoted properly. I'd like to know if allowing the attribute names to be attacker-chosen poses any additional risks over allowing the attribute values to be attacker-chosen.

Example: I might have a JSON value such as the following:

{
  "name": "me",
  "interests": "sewing",
  "comment": "hello world!"
}

Assume that both the attribute names (name, interests, comment) and attribute values (me, sewing, hello world!) can be freely chosen by the attacker. Also assume that they are properly quoted (e.g., they are always surrounded by double quotes; we escape backslashes and quote signs, to prevent breaking out of the quotes).

Is there anything I need to worry about that's specific to attacker-chosen attribute names?

Do I need to worry about an attacker choosing an attribute name like toString or valueOf or length or 0? Or names that start with an underscore?

Answer 1

There's no inherent security risk.

Of course, you remain at the mercy of the security of the library with which you are parsing the JSON, and you remain at the mercy of the security of the application which will make use of the parsed JSON.