About character string handling that can be placed in JSON communication

Japanese manual in json communication

due to json specifications, Japanese does not need to unicode escape If you do not unicode escape, it is not good for confidentiality leakage, but it is not good because it can be deciphered if it is decoded. Even so, security such as XSS is okay because you can escape the control string with the \ mark (→ What do you mean?)

↓ This is what you mean. Cross-site scripting

By registering the data enclosed in the script tag, the data may be read as a script tag in the browser and an invalid script may be executed. So the control string needs to be escaped.

--Session hijacking --The tag of the input form is embedded and personal information is stolen. --Displaying fake information on web pages --Forced operation on a web page

Japanese unicode escape problem in python

json standard library

Japaneseization can be realized by json.dumps (str, ensure_ascii = False).

If> ensure_ascii is true (the default value), then the output guarantees that all non-ASCII characters entered are escaped. If ensure_ascii is false, these characters will be printed as is.

However, if the above implementation is left as it is, the control string will not be escaped, which creates a vulnerability.

MUST be escaped JSON specification Control character code

the characters MUST be escaped: ※quotation mark, reverse solidus, and the control characters (U+0000 through U+001F).