I have a RESTful API, built in NODE.js that does what you would expect it to: consumes data and then makes it accessible. Currently, data being submitted to my server is nested form data:


or as a query string


SO when I parse it on the server, I get a JS array of objects with those particular fields. What I am wondering is, is it safe for me accept a string that I can JSON.parse and the process it?

data=(some stringified json object)

I am unsure if it's possible for malicious code or anything to be included in the JSON object that would blow up my server once run through a parser


  • funkatron.com/posts/safely-parsing-json-in-javascript.html tl;dr: use safe JSON parsers; avoid using eval. Apr 2, 2014 at 2:38
  • @RobertHarvey, I think the question is what sort of mischief could be expected even if a safe JSON parser is used. Apr 2, 2014 at 2:56
  • @JeffreyHantin You are correct, but Robert Harvey's answer is more or less exactly what I was looking for. Any additional implications are true for any data interchange system for format. Thank you both.
    – rpaskett
    Apr 2, 2014 at 3:46

1 Answer 1


JSON representation can be dense, certainly denser than a flat list of properties, so memory exhaustion and denial of service may be slightly easier.

Other than that, assuming your JSON parser is bulletproof, you're left with basically the same attacks that can be directed at a form-data or query-string based entry point, primarily various kinds of string injection attacks: SQL injection, client JavaScript injection, and so forth.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.