12

Are there any known security vulnerabilities with Django's JSON deserializer? Regarding Python deserializing protocols, the general concensus seems to be they're completely insecure, so avoid parsing untrusted data.

However, I'm considering a distributed web application where different servers exchange model records, formatted as JSON. The records themselves don't contain sensitive data, but I'm concerned about the ability for a hacked server breaching another server by sending maliciously formatted JSON. Is this possible?

I usually see Django's JSON serializer in public-facing environments, so I would hope it's hardened against this kind of thing, but I haven't been able to find any documentation addressing any security issues.

8
  • 1
    Are you enabling CSRF protection? That should go a long way towards ensuring security. Mar 7, 2012 at 15:05
  • What is "maliciously formatted json"?
    – Marcin
    Mar 7, 2012 at 15:06
  • 1
    @Marcin, JSON formatted to exploit some vulnerability in the parser, allowing execution of arbitrary instructions on the server.
    – Cerin
    Mar 7, 2012 at 15:26
  • @Cerin I know what malicious formatting is. I am asking you to provide an explanation or example of what maliciously formatted JSON would be.
    – Marcin
    Mar 7, 2012 at 15:39
  • 1
    @Marcin, I'm sorry you didn't understand my question, but there's no need to be rude.
    – Cerin
    Mar 8, 2012 at 1:26

2 Answers 2

4

By default when using simplejson, which is the default deserializer used by Django, the types of objects that can be converted from JSON into a Python object are limited. The only way this is not the case, is if you're doing some kind of specialized decoding utilizing the optional arguments to the loads() or load() methods or your own JSONDecoder object.

So, as long as you're using default decoding, you're pretty safe. But, if you're really concerned, you should be validating the loaded JSON data BEFORE you actually do anything with it.

1
  • OK, this is a very nice, over-general advice: "validate the loaded JSON" - what do I validate it with? Regular expressions? Check if size less than X? Pickle is unsafe by design, because it can call constructors of arbitrary objects, and JSON is quite passive. However, history knows cases like this one: kalzumeus.com/2013/01/31/… (this was actually because of using a too general parser: not JSON specific). We cannot rest completely assured without very heavy fuzzing such a parser. May 8, 2014 at 20:33
3

I'm having trouble working out what you think could be insecure (or secure) about JSON.

JSON is a text-based data exchange format. It doesn't have any security built-in. Django comes with some functions to serialize and deserialize querysets to JSON. But these can't be "malicious" or "insecure" - they're just data.

Some serialization protocols, eg pickling, can potentially be insecure because they can contain code, so could possibly be deserialized to run something that harms your system. Serialized models don't have that problem, because they don't contain code.

Of course, if you were using JSON to (for example) pass a list of model IDs to be deleted, then there is the potential for a malicious user to include a whole load of IDs you don't want deleted. But again this isn't the fault of JSON - it's up to you to ensure that your business logic correctly determines which elements a user is allowed to delete or modify.

2
  • 8
    But if the decoder is flawed then even data can be malicious. Mar 7, 2012 at 15:27
  • @Ignacio, Exactly. Plenty of applications that only read data (e.g. image viewers, music players, etc) have occasionally had this kind of vulnerability. I don't want to automatically assume Django is exempt.
    – Cerin
    Mar 7, 2012 at 16:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.