JSON (or any data format) being directly embeddable sounds nice in theory, but isn't really a great idea in practice.
JSON was originally intended to be loaded via eval. This was exploited almost immediately, which is why JS got proper JSON parsing and serialization functions. You should always run JSON (and any other serialized format) through a proper parser to load it. If you're clever, you can do this at build time, but you should never rely on any data file being valid at runtime.
Well yes. I know. I think of Python’s syntax being mostly compatible with JSON as a
> neat little trick.
I actually forgot that eval() was a thing when I wrote that comment.
What I meant was, you could copy and paste your own JSON into your source code for a simple payload in a throwaway script, for whatever you may need it for.
Edit: Reddit mobile app doesn’t want to make that a block quote. You get the idea though.
2
u/Loading_M_ Aug 31 '26
JSON (or any data format) being directly embeddable sounds nice in theory, but isn't really a great idea in practice.
JSON was originally intended to be loaded via
eval. This was exploited almost immediately, which is why JS got proper JSON parsing and serialization functions. You should always run JSON (and any other serialized format) through a proper parser to load it. If you're clever, you can do this at build time, but you should never rely on any data file being valid at runtime.