Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

Using a JSON.parse reviver to obfuscate fields

I am attempting to abuse a reviver function with JSON.parse.

I basically want to make certain fields "null".

If I do this:

var json_data = JSON.parse(j, function(key, value) {
  if (key == "name") {        
    return value;
  } else {
    return null;    
  }    
});

The entire json_data object ends up null. In fact, no matter what I make the else, that defines the value of the json_object.

Interestingly, this works as expected:

var json_data = JSON.parse(j, function(key, value) {
  if (key == "name") {        
    return "name";
  } else {
    return value;    
  }    
});

The property "name" now has a value of "name".

JSON in question:

var j = '{"uuid":"62cfb2ec-9e43-11e1-abf2-70cd60fffe0e","count":1,"name":"Marvin","date":"2012-05-13T14:06:45+10:00"}';

Update

I just realized that the inverse of what I want to do works as well so I can nullify the name field:

var json_data = JSON.parse(j, function(key, value) {
  if (key == "name") {        
    return null;
  } else {
    return value;    
  }    
});
like image 406
Toby Hede Avatar asked Feb 21 '23 12:02

Toby Hede


1 Answers

Through some experimentation, it looks like a final call is made to the function where the key is an empty string and the value is the top-level object:

> JSON.parse('{"hello": "world"}', function(k, v) { console.log(arguments); return v; })
["hello", "world"]
["", Object]

So you could use:

var json_data = JSON.parse(j, function(key, value) {
  if (key == "name" || key === "") {        
    return value;
  } else {
    return null;    
  }    
});

Now, since "" does appear to be a valid JSON key, to be 100% correct it might be better to use something like:

var json_data;
JSON.parse(j, function(key, value) {
  if (key == "name") {        
    return value;
  } else if (key === "") {
    json_data = value;
    return null;
  } else {
    return null;    
  }    
});

But that might be a little bit paranoid ;)

like image 59
David Wolever Avatar answered Feb 23 '23 00:02

David Wolever