Hacker News Reader

> you can reasonably parse an untrusted JSON using default configuration without getting yourself pwned.

If only this were true.

https://medium.com/r3d-buck3t/insecure-deserialization-with-...

I know that one, but I think JSON.NET is to blame for this because it decide to take `$type` and other fields and apply some reflection magic on it. It isn't really different from evaling a random json field in your own business code. A lot of sane json implementation also don't do this too, like `JSON.parse` `json.loads` `json.Unmarshal`...

On the other way, XML External Entity is a part of XML standard, so any standard compliant XML implementation have to support it. This is why XXE attack applies to many languages.

Reply on news.ycombinator.com