What can and cannot go wrong when you call JSON.parse on a string that arrived from an untrusted source?

## Start with what is genuinely safe The grammar has six value shapes and no way to name a type, invoke anything, or reference another node. Whatever text arrives, the result of parsing is a fresh tree of plain objects, arrays, strings, numbers, booleans and `null`. No constructor of yours runs; no method is attached; nothing is evaluated. That is the whole reason parsing replaced the old habit of evaluating a response as source code, and it is why the parse call itself is not an execution vector. Malformed text simply fails with a `SyntaxError`. That safety is narrower than it sounds. It says the *parse* runs no code. It says nothing about what your code then does with the tree. ## The "__proto__" key: safe on arrival, dangerous on use ```js const parsed = JSON.parse('{"__proto__":{"admin":true},"a":1}'); Object.getPrototypeOf(parsed) === Object.prototype; // true parsed.admin; // undefined Object.keys(parsed); // ['__proto__', 'a'] ``` Parsing defines properties directly on the new object rather than assigning them, so `"__proto__"` lands as an ordinary own data property. The object's prototype is untouched. People often stop here and conclude there is nothing to worry about. The danger is in the next step, because `Object.prototype` exposes `__proto__` as an **accessor**, and any ordinary property *assignment* with that key invokes its setter: ```js const target = {}; Object.assign(target, parsed); // assignment, not definition Object.getPrototypeOf(target) === Object.prototype; // false target.admin; // true ``` Copying the parsed object into another object replaced that object's prototype. A recursive deep-merge is worse still: such code typically reads `target[key]` to descend into it, and reading `target['__proto__']` yields `Object.prototype` itself, so the merge writes attacker-chosen properties onto the prototype every object in the process inherits from. Suddenly an unrelated `config.isAdmin` reads as `true` because nobody set it and the lookup walked the chain. The defensive moves are concrete: read only the keys you expect rather than copying wholesale; reject or strip a `"__proto__"` key at the boundary; use `Object.defineProperty` or a `Map` rather than assignment when copying untrusted keys; and prefer a merge implementation that skips `__proto__`, `constructor` and `prototype`. ## Duplicate keys: last one wins, silently ```js JSON.parse('{"role":"user","role":"admin"}'); // { role: 'admin' } ``` The grammar permits repeated names and the parser keeps the last. This matters whenever two different pieces of software read the same bytes — a gateway that checks one occurrence and a service that acts on another can be made to disagree, and neither sees anything malformed. If the text passes through more than one reader, canonicalise: parse once, and forward the re-serialized object rather than the original bytes. ## Numbers are parsed as doubles ```js JSON.parse('{"id":12345678901234567890}').id; // 12345678901234567000 ``` The grammar allows arbitrarily many digits; the language's number type does not. Large identifiers arrive already rounded, and no reviver can recover the original — by the time your callback runs, the value argument is a number and the text is gone. This is why identifiers are conventionally transmitted as strings. Very long decimal fractions round the same way. ## Cost is unbounded until you bound it Parsing materialises the entire document before returning, so peak memory scales with the input, and a reviver adds a callback invocation per node — its cost scales with key count, not byte count. There is no early exit and no streaming: you cannot decide halfway through that the document is too big. Any limit therefore has to be enforced *before* the call, on the received bytes, at whatever layer accepts them. ## What is not a risk here Be precise about the boundary, because overclaiming is as bad as underclaiming. Parsing cannot instantiate one of your classes, cannot call a getter you wrote, cannot trigger a network request, and cannot reach a global. There is no type-tag mechanism in the grammar for a document to say "build me one of these". A parsed value is dangerous only in proportion to what the surrounding code does with unvalidated shapes — passing it straight into a template, a query builder, a merge, or a function that assumes fields exist. ## The practical checklist 1. Bound the size of the input before parsing it. 2. Wrap the call so a malformed document produces a controlled failure rather than an unhandled exception. 3. Validate the parsed value's *shape* before use; parsing guarantees well-formedness, never correctness. 4. Read the fields you expect by name instead of merging the whole object into something. 5. Treat `__proto__`, `constructor` and `prototype` as keys to reject at the boundary. 6. Transmit large identifiers as strings, and compare them as strings.