When forming a JSON data structure, are there any security risks with allowing the field names to be chosen by an attacker? You can assume they'll be quoted properly. I'd like to know if allowing the attribute names to be attacker-chosen poses any additional risks over allowing the attribute values to be attacker-chosen.

Example: I might have a JSON value such as the following:

  "name": "me",
  "interests": "sewing",
  "comment": "hello world!"

Assume that both the attribute names (name, interests, comment) and attribute values (me, sewing, hello world!) can be freely chosen by the attacker. Also assume that they are properly quoted (e.g., they are always surrounded by double quotes; we escape backslashes and quote signs, to prevent breaking out of the quotes).

Is there anything I need to worry about that's specific to attacker-chosen attribute names?

Do I need to worry about an attacker choosing an attribute name like toString or valueOf or length or 0? Or names that start with an underscore?

  • 1
    If you're not evaluating JSON within Javascript eval() context, I don't see how these will matter - any name would be fine. If you do use this object inside JS context, then some names (like toString) might probably mess up the object's functionality, but if quoting is done properly I don't think you can do anything worse than that. – StasM Nov 14 '11 at 1:32
  • Just be sure to escape newline characters and "<" and you should be fine. If attribute values are strings, the worst thing that could happen is messing up with "magic" mathods like valueOf and the other you mentioned. – Krzysztof Kotowicz Nov 14 '11 at 2:27
  • @Krzysztof, StasM - Thanks for the reply. Regarding your statement that the worst that could happen is messing up valueOf or toString methods: well, that's exactly the question I am looking to have answered. Could an attacker who specifies an attribute named valueOf or toString cause any security problems for my application? I can't tell. Could it cause problems, or not? If yes, can you give an example? – D.W. Nov 14 '11 at 4:49
  • @D.W. you would have to allow functions as attribute values to be vulnerable. Strings are safe (unless you use the received object in some really quirky way). – Krzysztof Kotowicz Nov 14 '11 at 12:39
  • 2
    @ThiefMaster, some background: .valueOf() and .toString() are special. They get invoked implicitly by the Javascript interpreter all over the place, in places where you'd never guess (even though you never invoked them explicitly in your code). That's why I asked about them specifically. – D.W. Nov 14 '11 at 17:39

There's no inherent security risk.

Of course, you remain at the mercy of the security of the library with which you are parsing the JSON, and you remain at the mercy of the security of the application which will make use of the parsed JSON.

  • 1
    I agree. If proper parsing is done then strings are strings. It would require some other vulnerability to make use of strings or arbitrary fields to have any attack value. That being said, I would have significant length restrictions that would prevent a field or fields from storing the equivelent of a simple program. Also See IETF RFC 4627 for recomendations on parsing JSON. – this.josh Nov 15 '11 at 9:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.