I've got some code that does some validation on user supplied inputs (this example is a list of secrets, we do the same with other data).

This is a super simple example (without the validation), demonstrating an exploit. notsupplied is a variable set in the code, not something supplied by the user, to prove they can access things they shouldn't :

var notsupplied = "secret" 
var secrets = [{database: "dbpass"} , {ssh: "sshkey"} , {other: console.log(notsupplied)}]
for (var key in secrets) {console.log (secrets[key])} 

(Instead of the console.log(secrets[key]) it will actually do some validation on each secret.)

Now, you can see in this example, the naughty "other" secret can log a value the user didn't supply (I think it can run any code on the server at that point).

If we were taking inputs like this, then that would be bad. HOWEVER, the user is supplying their secrets as JSON in the body of a POST request. (The "is the input valid JSON?" checks are done before the code gets to the "check all the secrets are acceptable".)

We're using express / express-validator and are in an AWS Lambda behind an API GW. (in case that makes any difference to the answer!)

So, my question is : Does JSON provide enough sanitisation of values or is there some clever way to get around the "JSON defines seven value types: string, number, object, array, true, false, and null." and cause it to run code? (I don't know, some weird trick with a value with some more []s or a double escaped ; or you know, the usual suspects ;-) ? )

My CICD keeps complaining there is a remote code execution exploit here, but I think because the inputs are "sanitised" by being passed as JSON, that is sufficient.