{"id":22281444,"url":"https://github.com/owasp/json-sanitizer","last_synced_at":"2025-04-12T20:46:07.701Z","repository":{"id":30977110,"uuid":"34535364","full_name":"OWASP/json-sanitizer","owner":"OWASP","description":"Given JSON-like content, The JSON Sanitizer converts it to valid JSON.","archived":false,"fork":false,"pushed_at":"2023-11-22T18:08:29.000Z","size":761,"stargazers_count":211,"open_issues_count":9,"forks_count":50,"subscribers_count":19,"default_branch":"master","last_synced_at":"2025-04-04T00:09:45.305Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":"","language":"Java","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/OWASP.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2015-04-24T18:39:53.000Z","updated_at":"2025-03-04T01:54:47.000Z","dependencies_parsed_at":"2024-06-20T00:23:36.528Z","dependency_job_id":"a69952bd-0bfd-4da1-a37f-847073569c24","html_url":"https://github.com/OWASP/json-sanitizer","commit_stats":null,"previous_names":[],"tags_count":6,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/OWASP%2Fjson-sanitizer","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/OWASP%2Fjson-sanitizer/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/OWASP%2Fjson-sanitizer/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/OWASP%2Fjson-sanitizer/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/OWASP","download_url":"https://codeload.github.com/OWASP/json-sanitizer/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":248631702,"owners_count":21136559,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-12-03T16:18:17.933Z","updated_at":"2025-04-12T20:46:07.676Z","avatar_url":"https://github.com/OWASP.png","language":"Java","funding_links":[],"categories":[],"sub_categories":[],"readme":"# json-sanitizer [\u003cimg src=\"https://travis-ci.org/OWASP/json-sanitizer.svg\"\u003e](https://travis-ci.org/OWASP/json-sanitizer) [![Fuzzing Status](https://oss-fuzz-build-logs.storage.googleapis.com/badges/json-sanitizer.svg)](https://bugs.chromium.org/p/oss-fuzz/issues/list?sort=-opened\u0026can=1\u0026q=proj:json-sanitizer)\n\n\nGiven JSON-like content, The JSON Sanitizer converts it to valid JSON.\n\n[Getting Started](https://github.com/OWASP/json-sanitizer/blob/master/docs/getting_started.md) - [Contact](https://github.com/OWASP/json-sanitizer/blob/master/docs/contact.md)\n\nThis can be attached at either end of a data-pipeline to help satisfy\nPostel's principle:\n\n\u003e be conservative in what you do, be liberal in what you accept from others\n\nApplied to JSON-like content from others, it will produce well-formed JSON\nthat should satisfy any parser you use.\n\nApplied to your output before you send, it will coerce minor mistakes in\nencoding and make it easier to embed your JSON in HTML and XML.\n\n\n## Motivation\n\n![Architecture](https://github.com/OWASP/json-sanitizer/blob/master/docs/JSON-Sanitizer-Arch.png)\n\nMany applications have large amounts of code that uses ad-hoc methods\nto generate JSON outputs.\n\nFrequently these outputs all pass through a small amount of framework\ncode before being sent over the network.  This small amount of\nframework code can use this library to make sure that the ad-hoc\noutputs are standards compliant and safe to pass to (overly) powerful\ndeserializers like Javascript's `eval` operator.\n\nApplications also often have web service APIs that receive JSON from a\nvariety of sources.  When this JSON is created using ad-hoc methods,\nthis library can massage it into a form that is easy to parse.\n\nBy hooking this library into the code that sends and receives requests\nand responses, this library can help software architects ensure\nsystem-wide security and well-formedness guarantees.\n\n\n## Input\n\nThe sanitizer takes JSON like content, and interprets it as JS eval would.\nSpecifically, it deals with these non-standard constructs.\n\n| Construct     | Policy                                                        |\n|---------------|---------------------------------------------------------------|\n| `'...'`       | Single quoted strings are converted to JSON strings.          |\n| `\\xAB`        | Hex escapes are converted to JSON unicode escapes.            |\n| `\\012`        | Octal escapes are converted to JSON unicode escapes.          |\n| `0xAB`        | Hex integer literals are converted to JSON decimal numbers.   |\n| `012`         | Octal integer literals are converted to JSON decimal numbers. |\n| `+.5`         | Decimal numbers are coerced to JSON's stricter format.        |\n| `[0,,2]`      | Elisions in arrays are filled with `null`.                    |\n| `[1,2,3,]`    | Trailing commas are removed.                                  |\n| `{foo:\"bar\"}` | Unquoted property names are quoted.                           |\n| `//comments`  | JS style line and block comments are removed.                 |\n| `(...)`       | Grouping parentheses are removed.                             |\n\nThe sanitizer fixes missing punctuation, end quotes, and mismatched or\nmissing close brackets.  If an input contains only white-space then\nthe valid JSON string `null` is substituted.\n\n\n## Output\n\nThe output is well-formed JSON as defined by\n[RFC 4627](http://www.ietf.org/rfc/rfc4627.txt).\nThe output satisfies these additional properties:\n\n * The output will not contain the substrings (case-insensitively) `\"\u003cscript\"`, `\"\u003c/script\"` or `\"\u003c!--\"` and can thus be embedded inside an HTML script element without further encoding.\n * The output will not contain the substring `\"]]\u003e\"` and can thus be embedded inside an XML CDATA section without further encoding.\n * The output is a valid Javascript expression, so can be parsed by Javascript's `eval` builtin (after being wrapped in parentheses) or by `JSON.parse`.  Specifically, the output will not contain any string literals with embedded JS newlines (U+2028 Paragraph separator or U+2029 Line separator).\n * The output contains only valid Unicode [scalar values](http://www.unicode.org/glossary/#unicode_scalar_value) (no isolated [UTF-16 surrogates](http://www.unicode.org/glossary/#surrogate_pair)) that are [allowed in XML](http://www.w3.org/TR/xml/#charsets) unescaped.\n\n\n## Security\n\nSince the output is well-formed JSON, passing it to `eval` will\nhave no side-effects and no free variables, so is neither a code-injection\nvector, nor a vector for exfiltration of secrets.\n\nThis library only ensures that the JSON string → Javascript object\nphase has no side effects and resolves no free variables, and cannot\ncontrol how other client side code later interprets the resulting\nJavascript object.  So if client-side code takes a part of the parsed\ndata that is controlled by an attacker and passes it back through a\npowerful interpreter like `eval` or `innerHTML` then that client-side\ncode might suffer unintended side-effects.\n\n```JavaScript\nvar myValue = eval(sanitizedJsonString);  // safe\nvar myEmbeddedValue = eval(myValue.foo);  // possibly unsafe\n```\n\nAdditionally, sanitizing JSON cannot protect an application from\n[Confused Deputy attacks](http://en.wikipedia.org/wiki/Confused_deputy_problem)\n\n```JavaScript\nvar myValue = JSON.parse(sanitizedJsonString);\naddToAdminstratorsGroup(myValue.propertyFromUntrustedSource);\n```\n\n# Performance\n\nThe sanitize method will return the input string without allocating a new\nbuffer when the input is already valid JSON that satisfies the properties\nabove.  Thus, if used on input that is usually well formed, it has minimal\nmemory overhead.\n\nThe sanitize method takes O(n) time where n is the length of the input\nin UTF-16 code-units.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fowasp%2Fjson-sanitizer","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fowasp%2Fjson-sanitizer","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fowasp%2Fjson-sanitizer/lists"}