Is it valid to define functions in JSON results?
Part of a website\'s JSON response had this (... added for context):
{..., now:function(){return(new Date).getTime()}, ...}
Is adding anony
-
The problem is that JSON as a data definition language evolved out of JSON as a JavaScript Object Notation. Since Javascript supports eval on JSON, it is legitimate to put JSON code inside JSON (in that use-case). If you're using JSON to pass data remotely, then I would say it is bad practice to put methods in the JSON because you may not have modeled your client-server interaction well. And, further, when wishing to use JSON as a data description language I would say you could get yourself into trouble by embedding methods because some JSON parsers were written with only data description in mind and may not support method definitions in the structure.
Wikipedia JSON entry makes a good case for not including methods in JSON, citing security concerns:
Unless you absolutely trust the source of the text, and you have a need to parse and accept text that is not strictly JSON compliant, you should avoid eval() and use JSON.parse() or another JSON specific parser instead. A JSON parser will recognize only JSON text and will reject other text, which could contain malevolent JavaScript. In browsers that provide native JSON support, JSON parsers are also much faster than eval. It is expected that native JSON support will be included in the next ECMAScript standard.
讨论(0) -
A short answer is NO...
JSON is a text format that is completely language independent but uses conventions that are familiar to programmers of the C-family of languages, including C, C++, C#, Java, JavaScript, Perl, Python, and many others. These properties make JSON an ideal data-interchange language.
Look at the reason why:
When exchanging data between a browser and a server, the data can only be text.
JSON is text, and we can convert any JavaScript object into JSON, and send JSON to the server.
We can also convert any JSON received from the server into JavaScript objects.
This way we can work with the data as JavaScript objects, with no complicated parsing and translations.
But wait...
There is still ways to store your function, it's widely not recommended to that, but still possible:
We said, you can save a
string... how about converting your function to a string then?const data = {func: '()=>"a FUNC"'};Then you can stringify data using
JSON.stringify(data)and then usingJSON.parseto parse it (if this step needed)...And eval to execute a string function (before doing that, just let you know using eval widely not recommended):
eval(data.func)(); //return "a FUNC"讨论(0) -
although eval is not recommended, this works:
<!DOCTYPE html> <html> <body> <h2>Convert a string written in JSON format, into a JavaScript function.</h2> <p id="demo"></p> <script> function test(val){return val + " it's OK;} var someVar = "yup"; var myObj = { "func": "test(someVar);" }; document.getElementById("demo").innerHTML = eval(myObj.func); </script> </body> </html>讨论(0) -
Nope, definitely not.
If you use a decent JSON serializer, it won't let you serialize a function like that. It's a valid OBJECT, but not valid JSON. Whatever that website's intent, it's not sending valid JSON.
讨论(0) -
Function expressions in the JSON are completely possible, just do not forget to wrap it in double quotes. Here is an example taken from noSQL database design:
{ "_id": "_design/testdb", "views": { "byName": { "map": "function(doc){if(doc.name){emit(doc.name,doc.code)}}" } } }讨论(0)
加载中...
- 热议问题