title: cleaning JSON for XSS before deserializing
body: <p>I am using Newtonsoft JSON deserializer. How can one clean JSON for XSS (cross site scripting)? Either cleaning the JSON string before de-serializing or writing some kind of custom converter/sanitizer? If so - I am not 100% sure about the best way to approach this. </p>
  
  <p>Below is an example of JSON that has a dangerous script injected and needs "cleaning." I want a want to manage this before I de-serialize it. But we need to assume all kinds of XSS scenarios, including BASE64 encoded script etc, so the problem is more complex that a simple REGEX string replace.</p>
  
  <pre><code>{ "MyVar" : "hello&lt;script&gt;bad script code&lt;/script&gt;world" } 
  </code></pre>
  
  <p>Here is a snapshot of my deserializer ( JSON -> Object ):</p>
  
  <pre><code>public T Deserialize&lt;T&gt;(string json)
  {
      T obj;
  
      var JSON = cleanJSON(json); //OPTION 1 sanitize here
  
      var customConverter = new JSONSanitizer();// OPTION 2 create a custom converter
  
      obj = JsonConvert.DeserializeObject&lt;T&gt;(json, customConverter);
  
      return obj;
  }
  </code></pre>
  
  <p>JSON is posted from a 3rd party UI interface, so it's fairly exposed, hence the server-side validation. From there, it gets serialized into all kinds of objects and is usually stored in a DB, later to be retrieved and outputted directly in HTML based UI so script injection must be mitigated.</p>