title: Safely parsing a JSON string with unquoted keys
body: <p><a href="https://github.com/douglascrockford/JSON-js/blob/master/json2.js">json2.js</a> is strict requiring all object keys be double-quoted. However, in Javascript syntax <code>{"foo":"bar"}</code> is equivalent to <code>{foo:"bar"}</code>. </p>
  
  <p>I have a textarea that accepts JSON input from the user and would like to "ease" the restriction on double quoting the keys. I've looked at how json2.js validates a JSON string in four stages before it evals it. I was able to add a 5th stage to allow unquoted keys and would like to know if there are any security implications to this logic.</p>
  
  <pre><code>var data = '{name:"hello", age:"23"}';
  
  // Make sure the incoming data is actual JSON
  // Logic borrowed from http://json.org/json2.js
  if ( /^[\],:{}\s]*$/.test(data.replace(/\\(?:["\\\/bfnrt]|u[0-9a-fA-F]{4})/g, "@")
       .replace(/"[^"\\\n\r]*"|true|false|null|-?\d+(?:\.\d*)?(?:[eE][+\-]?\d+)?/g, "]")
       .replace(/(?:^|:|,)(?:\s*\[)+/g, ":") // EDITED: allow key:[array] by replacing with safe char ":"
       /** everything up to this point is json2.js **/
  
       /** this is the 5th stage where it accepts unquoted keys **/         
       .replace(/\w+\s*\:/g, ":")) ) { // EDITED: allow any alphanumeric key
  
    console.log( (new Function("return " + data))() );
  }
  else {
    throw( "Invalid JSON: " + data );
  }
  </code></pre>