Django JsonResponse with safe=False to D3

user_13821259 0
Viewed 585

Developing a project with Django which involves serving JSON data to templates for use in javascript using the D3 framework.

A pattern I am using quite a bit is to return a JsonResponse object from a Django view with an array of data. As I start to link up apps in the project, I am also starting to use this idea to pass data between views in different apps. To get this working, I also need to set a safe flag as False. e.g.

def my_view(request):

    data = [{'foo':'bar'}, {'but':'should'}, {'i':'care?'}]

    return JsonResponse(data, safe=False)

This works fine and I think I want to be passing arrays because it makes life easier in D3. But it perturbs me a bit to be using this flag. I am somewhat reassured by the description in the Django documentation, but cannot say I have much understanding of the risk.

django docs - jsonresponse

Any thoughts on how much of a security issue this potentially is, and what might be the best alternative approach if they are significant?

d3.js django json
1 Answers

As you rightly point out, sending non-dict JSON objects was a concern for EMCAScript 3 and earlier according to the Django documentation. (For those interested, here are the details of how the attack was executed.)

However, EMCAScript 5 was released in 2009 and was fully supported in major browsers by 2013. The release of EMCAScript 5 and subsequent browser adoption fixed this vulnerability, and it is now safe to send non-dict options. So, safe=False should only be relevant if you plan to support browsers released before 2013.

If your website restricts browser support (for example) by only offering TLS version 1.2 and 1.3 - any browser that supports TLS 1.2 and later will not be vulnerable to the JSON issue with EMCAScript, because those browser version came after EMCAScript 5 was fully implemented in major browsers.

In summary, there is little to no concern to setting this safe flag to False in the JSONResponse class. This is because the only possible way the vulnerability could be exploited is through ancient browsers.

user_2603450
Related