title: Is sanitizing JSON necessary?
body: <p>I think it's a well-known best practice on the web to mistrust any input. The sentence</p>
  
  <blockquote>
    <p>"All input is evil."</p>
  </blockquote>
  
  <p>is probably the most cited quote with respect to input validation. Now, for HTML you can use tools such as <a href="https://github.com/cure53/DOMPurify" rel="noreferrer">DOMPurify</a> to sanitize it.</p>
  
  <p>My question is if I have a Node.js server running Express and <a href="https://github.com/expressjs/body-parser" rel="noreferrer">body-parser</a> middleware to receive and parse JSON, do I need to run any sanitizing as well?</p>
  
  <p>My (maybe naive?) thoughts on this are that JSON is only data, no code, and if somebody sends invalid JSON, body-parser (which uses <code>JSON.parse()</code> internally) will fail anyway, so I know that my app will receive a valid JavaScript object. As long as I don't run eval on that or call a function, I should be fine, shouldn't I?</p>
  
  <p>Am I missing something?</p>