服务器端JSON字符串验证

Question

Is there a secure way to validate an incoming untrusted JSON string in php?

The client shows a dynamic form. The user can enter data into that form. The data needs to be saved on the server. The server will not work with the data, it will only pass it on to the client the next time the page is loaded in order to restore the forms values. Therefore I do not want to check every value separately and save it into its own database field.

I want to save it as a JSON string and insert it into the DOM as a object variable on every page load. Is there a secure way to sanitize the incoming JSON string for that?

Answer 1

If you're injecting the code into a script tag and you want to guarantee that it is pure Javascript code, without any potentially dangerous XSS vulnerabilities, the simple way would be to use PHP first to decode it and then to re-encode it.

$safeJSON = json_encode(json_decode($unsafeJSON));

Anything that is invalid JSON will return null when json_decode is called on it. In this case, the string "null" would be returned to your browser, which is unlikely to do any harm in this context!

---

It's worth noting, however, that what you are doing is only potentially unsafe because this is not actually JSON. When it's being used inside a script tag, it's simply a Javascript object literal. If you were using it as JSON, eg by doing an AJAX call, it would not be a security vulnerability because the browser will not recognise invalid JSON in a JSON.parse call. See this excellent blog post for more information on the difference between Javascript objects and JSON.