Skip to main content

JSON Policy Settings

[Policy] > [Basic Declassification Policy] > [JSON] Settings​

The JSON tab sets policies to block security threats that may be included in JSON files.
By controlling duplicate keys, executable links, embedded files, dangerous keys, operators, etc., you can defend against JSON-based attacks.

⚠️ The basic declassification policy setting authority is granted to [Administrator Type - Super Administrator], and
Administrator permission settings can be done in [Administrator] > [Administrator List].

Detailed Description of Settings Items​

Policy NameExplanation
Setting to Block Duplicate Keys in JSONSet whether to block when there are duplicate keys in JSON. If keys are duplicated, it is unpredictable which value will be applied, which may lead to changes in permissions or settings. --- There is a case where administrator privileges were obtained by exploiting this vulnerability (CVE-2017-12635).
Blocking settings for specified executable linksSpecifies the executable link schemes to be blocked when included in JSON. Executable schemes such as javascript, data, vbscript, and file can trigger code execution or file access when clicked. Input example) javascript;data;vbscript;file;
Blocking settings for specified embedded file formats (MIME)Specifies the file types (MIME) to block when included in JSON. The JSON file may contain files in base64, which poses a risk of executing malicious code. --- It is recommended to block executable files such as EXE or DLL by default. Setting it to an empty value will block all file types. Example input) application/x-dosexec;application/zip;
Setting Block for Designated Risk KeysSpecify the dangerous keys to block when including in JSON. _proto_, constructor, etc. are risk keys that can change internal operations and alter permissions/settings. (Related case: CVE-2018-16487) Input example) _proto_;constructor;
Blocking settings for specified operatorsSpecify the operators to block when included in JSON. The $ operator used in databases like MongoDB can execute arbitrary commands, leading to data tampering, theft, and privilege escalation. Input example) $where;$ eval;

Input Rules and Precautions​

  • Blocking settings for specified executable linksYou can enter multiple schemes separated by semicolons (;).
  • **Blocking settings for specified embedded file formats (MIME)**The MIME type is entered separated by semicolons (;), and setting it to an empty value will block all file types.
  • Setting Block for Designated Risk KeysYou can enter multiple keys separated by semicolons (;).
  • Blocking settings for specified operatorsYou can enter multiple operators separated by semicolons (;).

Reference Note​

TerminologyDefinitionSecurity Threats
Duplicate KeyWhen the same key is used more than once in a JSON fileIt is unpredictable what value will be applied, so permissions or settings may change.
Executable Link Schemeprotocols that trigger code execution or file access when clicking on javascript, data, vbscript, file, etc.It can lead to the execution of malicious code or access to the file system.
Embedded File (Base64)File included in the JSON file encoded in base64Malware can be included in the form of a file and executed.
Risk Key_proto_, special keys that can change the internal behavior of JavaScript such as constructorPrototype pollution attacks can change permissions or settings.
$ operatorQuery operators used in NoSQL databases such as MongoDBExecuting arbitrary commands can lead to data tampering, theft, and privilege escalation.
  • After changing the settings, you can check the records and restore them in the [Policy Change History] menu.