Security Audit Guidelines for JSON Tools

Guidelines:

• Schema Validation: Does the tool validate the incoming JSON against an expected schema (e.g., JSON Schema)? This ensures the structure and data types are correct before processing.
• Strict Parsing: Is the JSON parser configured for strict mode? Avoid parsers that allow comments, unquoted keys, single quotes, or trailing commas unless explicitly required and understood.
• Data Type and Format Validation: Beyond schema, are individual field values validated for expected format (e.g., dates, emails, URLs) and range (e.g., integer boundaries)?
• Escape/Sanitize Special Characters: If JSON field values are used in other contexts (databases, command lines, HTML output), are special characters correctly escaped or sanitized for that specific context?

Example Concept (Pseudo-code):

function process_user_input(json_string):
    // 1. Basic JSON parsing
    parsed_data = parse_json(json_string)
    if parsing_failed:
        log_error("Invalid JSON syntax")
        return error_response("Invalid input format")

    // 2. Schema Validation
    if not validate_json_schema(parsed_data, user_schema):
        log_error("JSON does not match schema")
        return error_response("Invalid data structure")

    // 3. Data Type and Value Validation
    user_name = parsed_data.get("name")
    user_age = parsed_data.get("age")

    if not is_string(user_name) or length(user_name) > 100:
        return error_response("Invalid name")
    if not is_integer(user_age) or user_age < 0 or user_age > 120:
        return error_response("Invalid age")

    // 4. Sanitize if using data in other contexts (e.g., HTML)
    sanitized_name = escape_html(user_name)

    // Proceed with processing validated and sanitized data

Guidelines:

• Contextual Output Encoding: Ensure data extracted from JSON is properly encoded based on where it will be used (e.g., HTML entity encoding for HTML output, prepared statements for SQL).
• Client-Side JSON Display: If JSON is sent to a browser for display, ensure it's delivered with the correct MIME type (`application/json`) and that client-side code correctly handles any embedded strings that might contain HTML or script tags (e.g., using safe methods like `textContent` instead of `innerHTML`).

Example (HTML context):

// Suppose JSON input contains: { "message": "<script>alert('XSS')</script>" }

// Bad practice (vulnerable to XSS):
// <div id="output"></div>
// document.getElementById('output').innerHTML = parsed_json.message;

// Good practice (prevents XSS):
// <div id="output"></div>
// document.getElementById('output').textContent = parsed_json.message;

// Or server-side encoding before embedding in HTML template:
// <div>{{ html_escape(parsed_json.message) }}</div>

Guidelines:

• Size Limits: Implement limits on the maximum size of incoming JSON payloads. Reject inputs exceeding this limit early.
• Nesting Depth Limits: Use parsers that have configurable limits on the maximum nesting depth for objects and arrays, or ensure the library handles deep nesting gracefully without causing stack overflows.
• Resource Monitoring: Monitor resource usage (CPU, memory) of the process handling JSON parsing. Implement timeouts or circuit breakers to prevent a single request from consuming all resources.
• Proof of Work/Throttling: For public-facing APIs, consider implementing rate limiting or simple proof-of-work mechanisms for large/complex requests if DoS is a major concern.

Guidelines:

• Logging: Ensure sensitive data (passwords, PII, payment info) is not inadvertently logged during JSON parsing or processing errors. Mask or remove sensitive fields before logging.
• Storage: If JSON data containing sensitive information is stored, ensure it is done securely (e.g., encryption at rest).
• Transmission: JSON containing sensitive data should only be transmitted over secure channels (e.g., HTTPS).
• Access Control: Ensure only authorized components or users can access or trigger the processing of JSON containing sensitive data.

Guidelines:

• Keep Libraries Updated: Regularly update JSON parsing libraries to the latest versions to incorporate security patches.
• Use Reputable Libraries: Prefer well-known, actively maintained JSON libraries from trusted sources.
• Dependency Scanning: Use automated tools to scan for known vulnerabilities in your project's dependencies, including JSON libraries.
• Avoid Risky Features: Be cautious with parser features like allowing references (`$ref`), code execution within JSON (though rare in standard JSON, some formats build on it), or dynamic object creation from keys.

Guidelines:

• Generic Error Messages: Return generic error messages to clients/users for parsing failures. Log detailed errors internally for debugging, but do not expose them externally.
• Consistent Error Responses: Provide consistent error response formats (e.g., a standard JSON error structure) that do not vary based on the type of input failure in a way that could reveal information.
• Fail Securely: Ensure that parsing errors lead to graceful failures or rejections, not unexpected behavior or uncaught exceptions that could be exploited.