<?xml version="1.0" encoding="UTF-8"?>
<rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:wfw="http://wellformedweb.org/CommentAPI/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
	xmlns:slash="http://purl.org/rss/1.0/modules/slash/"
	>

<channel>
	<title>B and E Blog &#187; JSON</title>
	<atom:link href="http://www.bandeblog.com/cat/programming/json/feed/" rel="self" type="application/rss+xml" />
	<link>http://www.bandeblog.com</link>
	<description>Just a couple of opinionated nerds talking about ColdFusion, PHP, and technology in general.</description>
	<lastBuildDate>Tue, 27 Oct 2009 21:04:42 +0000</lastBuildDate>
	<generator>http://wordpress.org/?v=2.8.4</generator>
	<language>en</language>
	<sy:updatePeriod>hourly</sy:updatePeriod>
	<sy:updateFrequency>1</sy:updateFrequency>
			<item>
		<title>ColdFusion: XSS Vulnerability in SerializeJSON()</title>
		<link>http://www.bandeblog.com/2009/08/coldfusion-xss-vulnerability-in-serializejson/</link>
		<comments>http://www.bandeblog.com/2009/08/coldfusion-xss-vulnerability-in-serializejson/#comments</comments>
		<pubDate>Sat, 01 Aug 2009 14:28:20 +0000</pubDate>
		<dc:creator>Eric</dc:creator>
				<category><![CDATA[Bugs]]></category>
		<category><![CDATA[ColdFusion]]></category>
		<category><![CDATA[JSON]]></category>
		<category><![CDATA[Programming]]></category>
		<category><![CDATA[Software]]></category>

		<guid isPermaLink="false">http://www.bandeblog.com/?p=79</guid>
		<description><![CDATA[There is a minor vulnerability in ColdFusion&#8217;s SerializeJSON() method.  ColdFusion fails to escape object keys correctly.
Here is a typical example of the expected way to use SerializeJSON():
&#60;cfset foo = StructNew()&#62;
	&#60;cfset foo['bar'] = 'Bar!'&#62;
	&#60;cfoutput&#62;
		&#60;script language='javascript'&#62;
		var foo = #serializeJSON(foo)#;
		&#60;/script&#62;
	&#60;/cfoutput&#62;
The output of this is:
&#60;script language='javascript'&#62;
var foo = {&#34;bar&#34;:&#34;Bar!&#34;};
&#60;/script&#62;
The bug is that object keys are not properly escaped, [...]]]></description>
		<wfw:commentRss>http://www.bandeblog.com/2009/08/coldfusion-xss-vulnerability-in-serializejson/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>ColdFusion: SerializeJSON() Recursion Error</title>
		<link>http://www.bandeblog.com/2009/07/coldfusion-serializejson-recursion-error/</link>
		<comments>http://www.bandeblog.com/2009/07/coldfusion-serializejson-recursion-error/#comments</comments>
		<pubDate>Fri, 31 Jul 2009 13:46:22 +0000</pubDate>
		<dc:creator>Eric</dc:creator>
				<category><![CDATA[Bugs]]></category>
		<category><![CDATA[ColdFusion]]></category>
		<category><![CDATA[JSON]]></category>
		<category><![CDATA[Programming]]></category>
		<category><![CDATA[Software]]></category>

		<guid isPermaLink="false">http://www.bandeblog.com/?p=72</guid>
		<description><![CDATA[In ColdFusion 8, Adobe introduced a new function called SerializeJSON(), which takes a single object of just about any type and returns a JSON representation of that object and its properties.  This can include objects which are not native ColdFusion types such as a Java object, and it does a respectable job of figuring out [...]]]></description>
		<wfw:commentRss>http://www.bandeblog.com/2009/07/coldfusion-serializejson-recursion-error/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
	</channel>
</rss>
