Django JSON De-serialization Security
I'm having trouble working out what you think could be insecure (or secure) about JSON.
JSON is a text-based data exchange format. It doesn't have any security built-in. Django comes with some functions to serialize and deserialize querysets to JSON. But these can't be "malicious" or "insecure" - they're just data.
Some serialization protocols, eg pickling, can potentially be insecure because they can contain code, so could possibly be deserialized to run something that harms your system. Serialized models don't have that problem, because they don't contain code.
Of course, if you were using JSON to (for example) pass a list of model IDs to be deleted, then there is the potential for a malicious user to include a whole load of IDs you don't want deleted. But again this isn't the fault of JSON - it's up to you to ensure that your business logic correctly determines which elements a user is allowed to delete or modify.
Are there any known security vulnerabilities with Django's JSON deserializer? Regarding Python deserializing protocols, the general concensus seems to be they're completely insecure, so avoid parsing untrusted data.
However, I'm considering a distributed web application where different servers exchange model records, formatted as JSON. The records themselves don't contain sensitive data, but I'm concerned about the ability for a hacked server breaching another server by sending maliciously formatted JSON. Is this possible?
I usually see Django's JSON serializer in public-facing environments, so I would hope it's hardened against this kind of thing, but I haven't been able to find any documentation addressing any security issues.