2

I am working on a non-critical script which will be run periodically - it's really just for the entertainment of the dev team. Because it's for fun, it does not really matter if it crashes sometimes (i.e.: I don't mind if upstream changes to the response format occasionally force me to update the script). However, it must be secure to run on my company's server.

The datasource for this script would be a JSONP response from a foreign server. I know that JSONP is not something I can fully trust to execute directly, since they could change their response to contain arbitrary JavaScript.

The response on the JSON page currently looks like this:

callback(INSERT_JSON_HERE);

If I extract the JSON by using a regex to remove the surrounding callback:

^callback\(([^)]*)\);$

and pass the extracted JSON string to JSON.parse(), will this approach be safe?

Reasoning: I am not executing any code directly from the foreign site. I just take a portion of their response which should contain JSON and pass it to JSON.parse(). If it does not contain JSON, JSON.parse will error out. If they change the callback or use some other code in place of the callback, the regex will not extract anything.

Improve this question
2
  • 1
    Are you running the script in a browser? If so, how are you getting around the same-origin policy to load the JSONP response (without executing it as a script itself)? The whole point of JSONP is, after all, bypassing same-origin policy.
    – CBHacking
    Commented Nov 25, 2015 at 6:52
  • 1
    @CBHacking: I am running the script on node.js. I didn't set up the server so I don't know for what reason the developer was trying to circumvent same origin, but it does not seem relevant to me. I just see a service that provides the data I need - in JSONP format.
    – Anon
    Commented Nov 25, 2015 at 17:29

1 Answer 1

Reset to default
1

If all you are doing is extracting JSON server side, then what you are doing is "safe so far".

Remember, security is all about the context that the data is then used. After all, data is just 1s and 0s. It is when you output it to HTML you should make sure it is safe and cannot contain scripts, or when you put it into a database that you make sure it is passed as data rather than part of the query.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .