Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Sure, and then only 10% of your use cases contain easily exploitable vulnerabilities.


You use a different function than Validate_Parsed_JSON in those cases. But most typescript programs are only going to need JSON-compatible input. Maybe some XML but that's also going to have similar formulaic output from your parser.

If something can directly hand you a maliciously built data structure, you're probably designing your system wrong. Are you running untrusted javascript in the same interpreter? That's a very hard problem that should be avoided if at all possible.

Basically, only working on JSON.parse is something to document but it's not at all a weird restriction, or a reason to balk at putting it into production.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: