Comment on On-demand JSON: A better way to parse documents?parentComments−basil-rash2yThat's fair, though somewhat benign barring a prototype pollution vulnerability. The object still behaves the same as it would had you JSON.parse'd the same string (Object.getPrototypeOf aside).−zerocrates2yOne simple issue would be if your object looks likex = {"__proto__": {"foo": "bar"}}now x.foo is "bar" if that's JS code, but undefined if you JSON.parse that same object definition from a string.
Comments
That's fair, though somewhat benign barring a prototype pollution vulnerability. The object still behaves the same as it would had you JSON.parse'd the same string (Object.getPrototypeOf aside).
One simple issue would be if your object looks like
x = {"__proto__": {"foo": "bar"}}
now x.foo is "bar" if that's JS code, but undefined if you JSON.parse that same object definition from a string.