Swift : JSON injection

The application writes data from an untrusted source to JSON file. This allows an attacker to change the structure and content of the file.

Applications typically use JSON to store data or for messaging. In the first case, JSON file is treated as a database and can contain valuable data. Web applications can also use massaging via JSON for valuable data exchange.

An attacker who has the ability to write data to the JSON document can change its semantics. In the most harmless case he/she can brake the document structure, whereby the JSON-parser exits with an error. In more serious cases, an attacker can add JSON elements changing the authentication data, change data (such as prices, if we are talking about a database of a store). In some cases, JSON Injection can lead to cross-site scripting (XSS) and remote code execution.