Safely parsing a JSON string with unquoted keys
[json2.js][1] is strict requiring all object keys be double-quoted. However, in Javascript syntax `{"foo":"bar"}` is equivalent to `{foo:"bar"}`. 

I have a textarea that accepts JSON input from the user and would like to "ease" the restriction on double quoting the keys. I've looked at how json2.js validates a JSON string in four stages before it evals it. I was able to add a 5th stage to allow unquoted keys and would like to know if there are any security implications to this logic.

    var data = '{name:"hello", age:"23"}';
    
    // Make sure the incoming data is actual JSON
    // Logic borrowed from http://json.org/json2.js
    if ( /^[\],:{}\s]*$/.test(data.replace(/\\(?:["\\\/bfnrt]|u[0-9a-fA-F]{4})/g, "@")
         .replace(/"[^"\\\n\r]*"|true|false|null|-?\d+(?:\.\d*)?(?:[eE][+\-]?\d+)?/g, "]")
         .replace(/(?:^|:|,)(?:\s*\[)+/g, "")
         /** everything up to this point is json2.js **/

         /** this is the 5th stage where it accepts unquoted keys **/         
         .replace(/[A-Za-z_]\w*\s*\:/g, ":")) ) {
    
      console.log( (new Function("return " + data))() );
    }
    else {
      throw( "Invalid JSON: " + data );
    }


  [1]: http://www.json.org/json2.js

Safely parsing a JSON string with unquoted keys
===

[json2.js][1] is strict requiring all object keys be double-quoted. However, in Javascript syntax `{"foo":"bar"}` is equivalent to `{foo:"bar"}`. 

I have a textarea that accepts JSON input from the user and would like to "ease" the restriction on double quoting the keys. I've looked at how json2.js validates a JSON string in four stages before it evals it. I was able to add a 5th stage to allow unquoted keys and would like to know if there are any security implications to this logic.

    var data = '{name:"hello", age:"23"}';
    
    // Make sure the incoming data is actual JSON
    // Logic borrowed from http://json.org/json2.js
    if ( /^[\],:{}\s]*$/.test(data.replace(/\\(?:["\\\/bfnrt]|u[0-9a-fA-F]{4})/g, "@")
         .replace(/"[^"\\\n\r]*"|true|false|null|-?\d+(?:\.\d*)?(?:[eE][+\-]?\d+)?/g, "]")
         .replace(/(?:^|:|,)(?:\s*\[)+/g, "")
         /** everything up to this point is json2.js **/

         /** this is the 5th stage where it accepts unquoted keys **/         
         .replace(/[A-Za-z_]\w*\s*\:/g, ":")) ) {
    
      console.log( (new Function("return " + data))() );
    }
    else {
      throw( "Invalid JSON: " + data );
    }


  [1]: http://www.json.org/json2.js
