OWASP JSON Sanitizer

= Main = 

{| style="padding: 0;margin:0;margin-top:10px;text-align:left;" |-
 * valign="top" style="border-right: 1px dotted gray;padding-right:25px;" |

OWASP JSON Sanitizer Project
Our Mission: Given JSON-like content, convert it to valid JSON! The OWASP JSON Sanitizer Project is a simple to use Java library that can be attached at either end of a data-pipeline to help satisfy Postel's principle: be conservative in what you do, be liberal in what you accept from others. When applied to JSON-like content from others, this project will produce well-formed JSON that should satisfy any parser you use. When applied to your output before you send, it will coerce minor mistakes in encoding and make it easier to embed your JSON in HTML and XML.

This library is very easy to use. For more information, visit the getting started guide.

Licensing
The OWASP JSON Sanitizer is free to use under the Apache 2 License.


 * valign="top" style="padding-left:25px;width:200px;border-right: 1px dotted gray;padding-right:25px;" |

What is this?
The OWASP JSON Sanitizer Projects provides:


 * Java based JSON outbound or inbound sanitization library

Code Repo
OWASP JSON Sanitizer at GitHub

Email List
Project Support List

Project Leaders
Author/Project Leader Mike Samuel [mailto:jim.manico@owasp.org @] Project Manager Jim Manico [mailto:jim.manico@owasp.org @]

Related Projects

 * XSS (Cross Site Scripting) Prevention Cheat Sheet
 * OWASP Java HTML Sanitizer Project
 * OWASP Java Encoder Project
 * OWASP Dependency Check
 * Sourceclear Headlines
 * Google KeyCzar
 * Apache SHIRO


 * valign="top" style="padding-left:25px;width:200px;" |

Quick Download

 * v1.0 at Maven Central
 * Getting Started with the JSON Sanitizer

News and Events

 * [July 5, 2014] v1 Released at Maven Central!
 * [March 29, 2014] Template and Doc cleanup!
 * [Oct 17, 2012] .9 Released!

Classifications

 * }

= Getting Started =

Importing the JSON Sanitizer
You can fetch the jars from Maven Central or you can let your favorite java package manager handle it for you via

com.mikesamuel json-sanitizer [1.0,) Once you've got the JSON sanitizer JAR on your classpath,

import com.google.json.JsonSanitizer; will let you call

String wellFormedJson = JsonSanitizer.sanitize(myJsonLikeString); That's it. Now wellFormedJson is a string of well-formed JSON that is safe to pass to JavaScript?'s eval operator and which can be easily embedded in XML or HTML.

If you have further questions, check our support list.

= Motivation =

The OWASP JSON Sanitizer Project is a simple to use Java library that can be attached at either end of a data-pipeline. When applied to JSON-like content from others, this project will produce well-formed JSON that should satisfy any parser you use. When applied to your output before you send, it will coerce minor mistakes in encoding and make it easier to embed your JSON in HTML and XML.



Many applications have large amounts of code that uses ad-hoc methods to generate JSON outputs. Frequently these outputs all pass through a small amount of framework code before being sent over the network. This small amount of framework code can use this library to make sure that the ad-hoc outputs are standards compliant and safe to pass to (overly) powerful deserializers like Javascript's eval operator.

Applications also often have web service APIs that receive JSON from a variety of sources. When this JSON is created using ad-hoc methods, this library can massage it into a form that is easy to parse.

By hooking this library into the code that sends and receives requests and responses, this library can help software architects ensure system-wide security and well-formedness guarantees.

= Input =

The sanitizer takes JSON like content, and interprets it as JS eval would. Specifically, it deals with these non-standard constructs.

The sanitizer fixes missing punctuation, end quotes, and mismatched or missing close brackets. If an input contains only white-space then the valid JSON string null is substituted.

= Output =

The output is well-formed JSON as defined by RFC 4627. The output satisfies three additional properties:


 * 1) The output will not contain the substring (case-insensitively) "&lt;/script" so can be embedded inside an HTML script element without further encoding.
 * 2) The output will not contain the substring "]]&gt;" so can be embedded inside an XML CDATA section without further encoding.
 * 3) The output is a valid Javascript expression, so can be parsed by Javascript's eval builtin (after being wrapped in parentheses) or by JSON.parse.  Specifically, the output will not contain any string literals with embedded JS newlines (U+2028 Paragraph separator or U+2029 Line separator).
 * 4) The output contains only valid Unicode scalar values (no isolated UTF-16 surrogates) that are allowed in XML unescaped.

= Security =

Since the output is well-formed JSON, passing it to eval will have no side-effects and no free variables, so is neither a code-injection vector, nor a vector for exfiltration of secrets.

This library only ensures that the JSON string → Javascript object phase has no side effects and resolves no free variables, and cannot control how other client side code later interprets the resulting Javascript object. So if client-side code takes a part of the parsed data that is controlled by an attacker and passes it back through a powerful interpreter like eval or innerHTML then that client-side code might suffer unintended side-effects.

var myValue = eval(sanitizedJsonString); // safe var myEmbeddedValue = eval(myValue.foo); // possibly unsafe Additionally, sanitizing JSON cannot protect an application from Confused Deputy attacks

var myValue = JSON.parse(sanitizedJsonString); addToAdminstratorsGroup(myValue.propertyFromUntrustedSource);

= Performance =

The sanitize method will return the input string without allocating a new buffer when the input is already valid JSON that satisfies the properties above. Thus, if used on input that is usually well formed, it has minimal memory overhead.

The sanitize method takes O(n) time where n is the length in UTF-16 code-units.

= Analogy =

The JSON Sanitizer is similar to a decoupling capacitor.

Any module that takes noisy input in and puts out clean output helps *decouple* the security properties of one piece of code (that uses eval) from the security properties of another (that concatenates untrusted strings to produce JSON) so that a failure in one does not necessitate a failure in the other.