Programmers Stack Exchange is a question and answer site for professional programmers interested in conceptual questions about software development. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am currently using the Google-Gson library to convert Java objects into JSON inside a web service.

Once the object has been converted to JSON, it is returned to the client to be converted into a JSON object using the JavaScript eval() function. Is the character escaping provided by the Gson library enough to ensure that nothing nasty will happen when I run the eval() function on the JSON payload?

Do I need to HTML Encode the Strings in the Java Objects before passing them to the Gson library? Are there any other security concerns that I should be aware of?

share|improve this question
just don't use eval, use JSON.parse (available in most modern browsers) – ratchet freak Nov 16 '12 at 15:50
If I were to use JSON.parse, would HTML Encoding the object on the server side provide any value? – SpeaksBinary Nov 16 '12 at 17:22
up vote 2 down vote accepted

No, Gson is not meant to be used to securely encode JSON in all possible cases. Instead, use a library dedicated to securely parse JSON. JSON.parse is a good example.

share|improve this answer
GSON does indeed encode anything I throw at it and even needs special calls to disable encoding things it doesn't have to, like HTML. That said, I voted this up because the correct answer is not to parse JSON on the receiver side with eval, but to use the linked method. So ++. – Lance Nanek Jun 11 '14 at 16:14

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.