Review JSON Security

[mitsuhiko]

ECMAscript 5 changed behavior of Array literals. That part of the documentation is outdated by now. We should check what browsers are affected by this and update the docs accordingly.

[duaneking]

Can you please explain what you mean by 'security issues'?

pallets-eco/flask-sqlalchemy#229

[mitsuhiko]

The linked issue is unrelated to this one.

[duaneking]

The linked issue was closed due to a statement by you that reflected the idea that it was a security issue; Wouldnt this being about that same security issue mean they are related?

Also, with respect, you didn't answer my question as to what the security issue was.

[davidism]

The security issue mentioned on that issue has nothing to do with JSON. The issue he talks about there is exposing sensitive data unless attributes are whitelisted. He makes the point that if attributes are whitelisted we might as well manually serialize the objects. The conclusion is that an automatic solution is not appropriate for the extension, but should be implemented in the author's application.

[duaneking]

Respectfully, The problem here is that @mitsuhiko has claimed on multiple topics that he is closing them due to security concerns, but has not in any of these cases clarified what that exact security concern is in that context. The result is the current misunderstanding.

[DasIch]

@duaneking The jsonify() feature you proposed, mirrors well known similar features in Ruby on Rails and Django in regard to automatic form generation and parsing of query arguments that caused severe security issues in a huge number of web applications, using these frameworks. Both projects have either deprecated or already removed such features. In general automatically generating anything users can interact with using a non-whitelist method is likely to cause information leakage, unauthorized writes and may provide a vector for DoS attacks.

If that isn't obvious to you (as you might have gathered it is, to several other people), you should educate yourself on basic security measures when writing software in general and web applications in particular. Reading about security issues (Django has excellent documentation on those) can also be very helpful.

[duaneking]

Respectfully, Please stop making assumptions about what I do or do not know. Its rude, and quit frankly as developers we should treat each other better than you just treated me.

I'm fully aware of these issues in other frameworks; I'm also fully aware that other people making a mistake is on them, not on me in any way. I'm not going to ever accept the false idea that what other people choose to do somehow can be blamed on me. They have freedom of choice; Its up to them to be responsible for their own actions.

The jsonify issue as you pointed out, was separate from this; Why troll me?

[untitaker]

This bug has nothing to do with database models. In case you decide not to derail this issue for once, please consider we already agreed that the current array-restriction in Flask's jsonify is unnecessary, which is exactly what you're advocating. Unless you have something new to say on that topic, spare the overly aggressive drive-by remarks.

[nickretallack]

How about we make it easy to opt out of this feature, and check for it specifically? My patch should do that. Please review.