1

I am currently using the Google-Gson library to convert Java objects into JSON inside a web service.

Once the object has been converted to JSON, it is returned to the client to be converted into a JSON object using the JavaScript eval() function. Is the character escaping provided by the Gson library enough to ensure that nothing nasty will happen when I run the eval() function on the JSON payload?

Do I need to HTML Encode the Strings in the Java Objects before passing them to the Gson library? Are there any other security concerns that I should be aware of?

2
  • 1
    just don't use eval, use JSON.parse (available in most modern browsers)
    – ratchet freak
    Commented Nov 16, 2012 at 15:50
  • If I were to use JSON.parse, would HTML Encoding the object on the server side provide any value?
    – SpeaksBinary
    Commented Nov 16, 2012 at 17:22

1 Answer 1

Reset to default
2

No, Gson is not meant to be used to securely encode JSON in all possible cases. Instead, use a library dedicated to securely parse JSON. JSON.parse is a good example.

1
  • GSON does indeed encode anything I throw at it and even needs special calls to disable encoding things it doesn't have to, like HTML. That said, I voted this up because the correct answer is not to parse JSON on the receiver side with eval, but to use the linked method. So ++.
    – Lance Nanek
    Commented Jun 11, 2014 at 16:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.