Tag Info

Hot answers tagged

10

Suppose I have a server-side variable containing JSON, called strJSON that my own code created. Was it created entirely by your code? Are you certain that at no point does it add in a piece of user input? Are you also certain that at no point in the future will it ever be modified to add in data that comes from user input? If you can be 100% sure of ...


3

If the JSON string is encoded entirely under your control, it is exploitable to the extent that your encoding method is broken. That said, you should be safe if you're performing a straightforward serialization using a trusted serializer, like so: var js = new JavaScriptSerializer(); var thingy123 = ThingyRepo.Get(123); var json = js.Serialize(thingy123); ...


2

You should assume that the server-side dataobjects use their own conventions, and the client-side would have its own. When fetching/posting data, you can set up a model adapter to handle switching between the two. By doing it at this level, each side uses their own conventions that make sense in each's contexts. After fetching your data from an ajax get, ...


1

No, there is nothing wrong with evaluating your own code, if you know for certain it's safe. Too many get caught up in blindly following rules. Evaluation of code in a string seems to really bring out strong opinions for some reason. Evaluation of code in a string is a tool. Learn what it does, how it works, and why it can be unsafe. When you really ...


1

Parsing chunks from a stream is usually an issue. One of the issues is that you often need to know the size of the packet to allocate the buffer needed to hold it while parsing. Most text based formats don't have that instead they are delimited by a special set of characters (JSON it's the closing brace/bracket). If you elect for a binary transmission I ...


1

Another alternative (using HATEOS). This is simple, mostly in practice you add a links tag in the json depending on your use of hateos. http://api.example.com/games/1: { "id": 1, "title": "Game A", "publisher": "Publisher ABC", "developer": "Developer DEF", "releaseDate": "2015-01-01", "platforms": [ {"_self": ...


1

You're basically writing a compiler, which translates from SQL to whatever your datastore understands. In the end, you'll probably have the following parts: a Parser which takes SQL and produces an Abstract Syntax Tree a bunch of Visitors which do semantic analysis and/or rewriting on the AST an Interpreter which finally executes the (processed) query ...


1

I think option 2 is your best bet. While the public and admin sites are related and use the same DB most likely, admin use cases and work flows typically have little overlap with the use cases and workflows in the public site. So the admin site will likely have its own distinct set of business logic. You can certainly move code which is common into ...



Only top voted, non community-wiki answers of a minimum length are eligible