title: Is it possible to XSS exploit JSON responses with proper JavaScript string escaping?
body: <p>JSON responses can be exploited by overriding Array constructors or if hostile values are not JavaScript string-escaped.</p>
  <p>Let's assume both of those vectors are addressed in the normal way. Google famously traps JSON response direct sourcing by prefixing all JSON with something like:</p>
  <pre><code>throw 1; &lt; don't be evil' &gt;
  </code></pre>
  <p>And then the rest of the JSON follows. So Dr. Evil cannot, using the sort of exploit discussed <a href="https://web.archive.org/web/20150415201603/http://sla.ckers.org/forum/read.php?2,25788" rel="nofollow noreferrer">here</a>. Get your cookie (assuming you're logged in) by putting the following on his site:</p>
  <pre class="lang-html prettyprint-override"><code>&lt;script src=&quot;http://yourbank.com/accountStatus.json&quot;&gt; 
  </code></pre>
  <p>As for string escaping rules, well if we're using double quotes, we need to prefix each with a backslash and each backslash with another backslash etc.</p>
  <p>But my question is, what if you're doing all of this?</p>
  <p><a href="https://portswigger.net/burp" rel="nofollow noreferrer">Burp Suite</a> (the automated security tool) detects embedded XSS attempts that are returned unHTML-escaped in a JSON response and it reports it as an XSS vulnerability. I have a report that my application contains vulnerabilities of this kind but I am not convinced. I've tried it and I can't make an exploit work.</p>
  <p>So I don't think this is correct.</p>
  <p>There is one specific case, that of IE MIME-type sniffing that I think could result in an exploit. After all, IE 7 still had the &quot;feature&quot; that script tags embedded in image comments were executed regardless of the Content-Type header. Let's also leave such clearly stupid behaviour aside at first.</p>
  <p>Surely the JSON would be parsed by either the native JavaScript parser (Window.JSON in Firefox) or by an <code>eval()</code> as per the old default jQuery behaviour. In neither case would the following expression result in the alert being executed:</p>
  <pre><code>{&quot;myJSON&quot;: &quot;legit&quot;, &quot;someParam&quot;: &quot;12345&lt;script&gt;alert(1)&lt;/script&gt;&quot;}
  </code></pre>
  <p>Am I right or am I wrong?</p>