1449476 - ZDI-CAN-5701: Mozilla Web Docs Sample Code JSON.parse Polyfill XSS Vulnerability

Status: RESOLVED FIXED

(Developer Documentation Graveyard :: JavaScript, defect)

Description

[Daniel Veditz [:dveditz]]

-- ABSTRACT -------------------------------------

Trend Micro's Zero Day Initiative has identified a vulnerability
affecting the following products:

  Mozilla MDN Web Docs


-- VULNERABILITY DETAILS ------------------------

Sample code offered in Mozilla documentation recommends an insecure
polyfill for JSON.parse. At one point the dangerous code was removed but
it was subsequently added back.

https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/JSON

Quote:
=============

Polyfill
The JSON object is not supported in older browsers. You can work around
this by inserting the following code at the beginning of your scripts,
allowing use of JSON object in implementations which do not natively
support it (like Internet Explorer 6).

The following algorithm is an imitation of the native JSON object:

```
if (!window.JSON) {
  window.JSON = {
    parse: function(sJSON) { return eval('(' + sJSON + ')'); },
...
```

=============
Close quote.

This use of eval can produce unwanted script execution. When parsing
JSON originating from an untrusted party, this constitutes an XSS
vulnerability.

The dangerous code was removed in revision 31806 on 3/30/2012 but was
subsequently added back in revision 31810 on 4/12/2012. A moderator
should remove and permanently ban this code.

-- CREDIT ---------------------------------------

This vulnerability was discovered by:

   Simon Zuckerbraun - Trend Micro Zero Day Initiative working with
Trend Micro's Zero Day Initiative

Comment 1

[Daniel Veditz [:dveditz]]

Gijs removed this and it was restored 2 weeks later by "fusionchess".

I've restored Gijs's original text. For some reason that I don't see in edit mode the new text is green. Is that just a signal that it's new in case people want to be suspicious of it?

Comment 2

[:Gijs (he/him)]

(In reply to Daniel Veditz [:dveditz] from comment #1)
> Gijs removed this and it was restored 2 weeks later by "fusionchess".
> 
> I've restored Gijs's original text. For some reason that I don't see in edit
> mode the new text is green. Is that just a signal that it's new in case
> people want to be suspicious of it?

It looks like you copied it from a diff view so there were <span class="diff-add"> things in the markup. Fixed by using the 'source' button in the editor and removing those tags. Looks OK to me now.

Comment 3

[John Whitlock [:jwhitlock]]

Since this is an in-content issue, moving to Developer Documentation: JavaScript. Page watchers can help verify that the polyfill doesn't return.