将eval（）转换为JSON.parse

Question

I was going through the ill-effects of using eval() with respect to XSS based attacks. There is a piece of code which I need to protect against a possible XSS attack, and what I guess that JSON.parse() should work fine.

var request = new XMLHttpRequest(); 
var url = encDataPath + "/jcr:content/metadata.json?_charset_=utf-8";
url = Granite.HTTP.externalize(url);
request.open("GET", url ,false);
request.send(null);

var jsonData =eval("(" + request.responseText + ")"); // <-- here
var assetTitle = jsonData["dc:title"];
var mimetype = jsonData["dc:format"];

Can someone advise how can I change the eval() (for jsonData) to JSON.parse?

Answer 1

Just replace that line with:

var jsonData = JSON.parse(request.responseText);

Provided the response is proper JSON, this should just work.

Answer 2

Assuming that the response is well-behaved JSON, you would be able to simply replace the eval line with:

var jsonData = JSON.parse(request.responseText);

Beware though: the JSON parser is very restrictive in the values that it will accept, compared to the Javascript objects that eval would accept. For instance,

var jsVal = eval("({a:3})");

will result in the Object {a: 3}, whereas

var jsonVal = JSON.parse("{a:3}");

will result in a parse error because the JSON specification[0] requires object keys to be provided as double-quoted strings:

var jsonVal = JSON.parse('{"a":3}');

If the server is properly configured it will generally output compliant JSON but it is something to be aware of.

[0] http://www.json.org/