Is getting JSON data with jQuery safe?

Question

JSON allows you to retrieve data in multiple formats from an AJAX call. For example:

$.get(sourceUrl, data, callBack, \'json\');

could be used

Answer 1

The last time I looked (late 2008) the JQuery functions get() getJSON() etc internally eval the JSon string and so are exposed to the same security issue as eval.

Therefore it is a very good idea to use a parsing function that validates the JSON string to ensure it contains no dodgy non-JSON javascript code, before using eval() in any form.

You can find such a function at https://github.com/douglascrockford/JSON-js/blob/master/json2.js.

See JSON and Broswer Security for a good discussion of this area.

In summary, using JQuery's JSON functions without parsing the input JSON (using the above linked function or similar) is not 100% safe.

NB: If this sort of parsing is still missing from getJSON (might have recently been added) it is even more important to understand this risk due to the cross domain capability, from the JQuery reference docs:

As of jQuery 1.2, you can load JSON data located on another domain if you specify a JSONP callback, which can be done like so: "myurl?callback=?". jQuery automatically replaces the ? with the correct method name to call, calling your specified callback.