Tickets :: Comment on [#5307] Upgrade Prototype to 1.5.1

* Your Email Address
* Spam protection	Enter the letters below: .__ . ..__ .__ __. [__)\ /\| \[__)(__ \| \ \/ \|__/\| .__)
Comment	>> I'll have to think about that one a bit more myself. Meanwhile, we > >> use it in Gollem in a similar style as to IMP/DIMP I believe. > > > > Outputting JSON directly in our javascript includes is no different > than writing some javascript code such as "var a = { b: 1 };". That > is JSON, but you can't tell me we need to run every single object we > create through evalJSON(). > > > > I think the question boils down to "how much do we trust any input > that we are outputting via JSON." Obviously, we can exploit all we > want if we ourselves are outputting bad JSON. But if that is > happening, we are either scheming and mischievous people (unlikely) > or we need to do a better job of filtering the data on the PHP side > rather than the browser side.
Attachment
Watch this ticket