Hacker News Reader

Comment by powrtoch | Hacker News Reader

I feel really dense, but I don't understand why the example line is throwing an error. The article mentions line terminators, but it doesn't seem to contain any, and I also don't understand why "owned" would be escaped the way the author says... it looks as though the interpreter is just rejecting the use of quotes around the key. But I'm sure I'm just missing something, so I'd be much obliged if someone could enlighten me.

View on HN

There's an invisible-to-the eye unicode character in the string "owned," if you copy and paste the text from the website.

JSON is fine with these characters, but JavaScript is not.

For plain-jane JSON this is usually fine, since you're not just evaluating the JSON as JavaScript, but are running the returned data through a JSON parser. A properly-designed JSON parser will escape any JSON-valid-but-JavaScript-invalid characters.

JSONP, however, works differently and will use use the JavaScript parser. Womp womp.

The blog post also lists two other cases, although the first case -- parsing JSON using eval -- is both insecure and incorrect. I haven't seen people do that in ages and ages.

That makes sense. I was confused because I was also getting the error when I typed the line into the interpreter by hand. The issue being that I forgot to assign it to a variable (facepalm). Thanks for the explanation.

Just an fyi, jQuery's core JSON parser actually uses eval (well, new Function(), which is almost the same, but with scope protection).

https://github.com/jquery/jquery/blob/master/src/core.js#L52...

Looks like someone should send a pull request then.

To be fair, it does escape characters and verify with a regex that the data is actually JSON before eval-ing it.

The line terminator is there, it just doesn't render as anything visible. (It's inserted directly as a unicode character, rather than it's HTML-escaped equivalent, so you won't even see it if you view source!)

However, if you take a hex dump of the page, it becomes quite apparent:

https://gist.github.com/4393892

Note: The file is UTF-8 encoded, so you'd be looking for E2 80 A8 instead of \u2028.

Reply on news.ycombinator.com