I am currently using the Google-Gson library to convert Java objects into JSON inside a web service.

Once the object has been converted to JSON, it is returned to the client to be converted into a JSON object using the JavaScript eval() function. Is the character escaping provided by the Gson library enough to ensure that nothing nasty will happen when I run the eval() function on the JSON payload?

Do I need to HTML Encode the Strings in the Java Objects before passing them to the Gson library? Are there any other security concerns that I should be aware of?

  • 1
    just don't use eval, use JSON.parse (available in most modern browsers) – ratchet freak Nov 16 '12 at 15:50
  • If I were to use JSON.parse, would HTML Encoding the object on the server side provide any value? – SpeaksBinary Nov 16 '12 at 17:22

No, Gson is not meant to be used to securely encode JSON in all possible cases. Instead, use a library dedicated to securely parse JSON. JSON.parse is a good example.

| improve this answer | |
  • GSON does indeed encode anything I throw at it and even needs special calls to disable encoding things it doesn't have to, like HTML. That said, I voted this up because the correct answer is not to parse JSON on the receiver side with eval, but to use the linked method. So ++. – Lance Nanek Jun 11 '14 at 16:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.