Re:JSON-Based Universal Messaging Format (2017)
by linschn on Wednesday June 13, 2018 @02:12PM
(#17305636)
If you evaluate it in an environment where only the functions you choose are defined, the security risk is nil.
Validating a document is a complex, domain-dependant problem. It is far easier to create a secure Domain-Specific Language to handle this than to end up with an accidentally Turing complete abomination like XSLT: http://www.unidex.com/turing/utm.htm
Re:JSON-Based Universal Messaging Format (2017)
by krapp on Wednesday June 13, 2018 @09:13PM
(#17308468)
>If you evaluate it in an environment where only the functions you choose are defined, the security risk is nil.
Oh. So all you have to do is write perfectly secure code and run it in a perfectly secure environment, and nothing bad can possibly happen.
Well shit, why didn't anyone else ever think of that?
And, yes, it's possible to have vulnerabilities in a JSON parser--but it is orders of magnitude easier to have them in an arbitrary language parser.