HIGHCWE-436
PARSE-001 JSON Comment Injection
Parser Differential: Exploits differences in how parsers (JSON, YAML, markdown) interpret the same input to bypass security controls
Description
Injects JavaScript-style comments into JSON that strict parsers reject but lenient parsers (JSON5, JSONC) accept, hiding malicious instructions
Remediation
Use strict JSON parsing only. Reject inputs with comments, trailing commas, or non-standard JSON extensions. Validate parsed output matches a strict schema.