• 使用安全json parser防止json注入



    有些程序员如果没有很好的在javascript中解析json数据,往往会直接eval把json转成js对象,这时候如果json的数据中包含了被注入的恶意数据,则可能导致代码注入的问题。

    正确的做法是分割出json里包含的特殊字符,然后再解析为对象

    http://json.org/json2.js 中是通过正则来完成的。

    // We split the second stage into 4 regexp operations in order to work around
    // crippling inefficiencies in IE's and Safari's regexp engines. First we
    // replace the JSON backslash pairs with '@' (a non-JSON character). Second, we
    // replace all simple value tokens with ']' characters. Third, we delete all
    // open brackets that follow a colon or comma or that begin the text. Finally,
    // we look to see that the remaining characters are only whitespace or ']' or
    // ',' or ':' or '{' or '}'. If that is so, then the text is safe for eval.


    if (/^[\],:{}\s]*$/.
    test(text.replace(/\\(?:["\\\/bfnrt]|u[0-9a-fA-F]{4})/g, '@').
    replace(/"[^"\\\n\r]*"|true|false|null|-?\d+(?:\.\d*)?(?:[eE][+\-]?\d+)?/g, ']').
    replace(/(?:^|:|,)(?:\s*\[)+/g, ''))) {

    // In the third stage we use the eval function to compile the text into a
    // JavaScript structure. The '{' operator is subject to a syntactic ambiguity
    // in JavaScript: it can begin a block or an object literal. We wrap the text
    // in parens to eliminate the ambiguity.

    j = eval('(' + text + ')');
    目前不少写的好的框架和js解析函数都取用了这种做法。

    所以,以后千万别直接eval了。
  • 相关阅读:
    [UWP]如何使用Fluent Design System (下)
    [UWP]如何使用Fluent Design System (上)
    [UWP]了解IValueConverter
    [UWP]了解TypeConverter
    [UWP]本地化入门
    [WPF]本地化入门
    [UWP]创建一个进度按钮
    [UWP]分享一个基于HSV色轮的调色板应用
    [UWP]使用Writeable​Bitmap创建HSV色轮
    [UWP]理解及扩展Expander
  • 原文地址:https://www.cnblogs.com/ghx88/p/1460168.html
Copyright © 2020-2023  润新知