To ensure my application has URL-friendly capabilities, I am storing its context as a JSON within the URL. This results in something like:
http://mysite.dev/myapppage/target#?context={%22attr1%22%3A{%22target_id-0%22%3A{%22value%22%3A%223%22%2C%22label%22%3A%22Hello%22}}}
This encodes a simple context:
{
"attr1":
{
"target_id-0":
{
"value": "3",
"label": "Hello"
}
}
}
I serialize my object using:
JSON.stringify(context)
And deserialize it using:
var hashParamsElements = window.location.toString().split('?');
hashParamsElements.shift(); // we skip the first part of the URL
var hashParams = $.deparam(hashParamsElements.join('?'));
var contextString = hashParams.context;
var context = JSON.parse(contextString);
The context is only stored to read variables; there is no executed code within it. Is this method XSS safe?
If there is a threat, how can I mitigate it?