JsonResponse and list values

[Curtis Maloney]

Ran into this bug this morning... what's the rationale behind JsonResponse only accepting dict types unless you set safe=False to allow _any_ type?

Surely list/tuple should also be permitted?

There's a test explicitly ensuring lists fail.

I'm not comfortable turning off ALL type safe-guards just so I can send lists as JSON results.

--

Curtis

[Florian Apolloner]

On Tuesday, February 17, 2015 at 12:30:25 AM UTC+1, Curtis Maloney wrote:

Ran into this bug this morning... what's the rationale behind JsonResponse only accepting dict types unless you set safe=False to allow _any_ type?

Cause dict maps to object which is somewhat safe.
 

Surely list/tuple should also be permitted?

No, the safeguard is especially for those! See http://haacked.com/archive/2008/11/20/anatomy-of-a-subtle-json-vulnerability.aspx/ and http://incompleteness.me/blog/2007/03/05/json-is-not-as-safe-as-people-think-it-is/ for details.

Cheers,
Florian

[Curtis Maloney]

Cheers for the quick reply... well, you learn more about how shit JS is every day :P

--

C

--
You received this message because you are subscribed to the Google Groups "Django developers (Contributions to Django itself)" group.
To unsubscribe from this group and stop receiving emails from it, send an email to django-develop...@googlegroups.com.
To post to this group, send email to django-d...@googlegroups.com.
Visit this group at http://groups.google.com/group/django-developers.
To view this discussion on the web visit https://groups.google.com/d/msgid/django-developers/c31944e1-a4f5-4ed9-91e0-aee9f2d7fb9c%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

[Tom Christie]

I haven't dug out sources on this, but I think that vulnerability had been dealt with a long time ago, and isn't an issue on browsers with any real market share today.

Would need to double check though - don't remember where I came across it previously.

[schinckel]

My attempts to reproduce it (I have quite a lot of code that returns JSON arrays) on the smattering of browsers I had handy resulted in no apparent vulnerabilities.