Switched to using new Function instead of eval for handling JSON parsing (Fixes bug #4680). Added support for JSON.parse, if it exists (Fixes bug #4429).

1 files changed, 14 insertions, 6 deletions

diff --git a/src/ajax.js b/src/ajax.js
index bffbeb607..4db08a4dc 100644
--- a/src/ajax.js
+++ b/src/ajax.js
@@ -481,24 +481,32 @@ jQuery.extend({
 			xml = type == "xml" || !type && ct && ct.indexOf("xml") >= 0,
 			data = xml ? xhr.responseXML : xhr.responseText;
 
-		if ( xml && data.documentElement.tagName == "parsererror" )
+		if ( xml && data.documentElement.tagName == "parsererror" ) {
 			throw "parsererror";
+		}
 
 		// Allow a pre-filtering function to sanitize the response
 		// s != null is checked to keep backwards compatibility
-		if( s && s.dataFilter )
+		if ( s && s.dataFilter ) {
 			data = s.dataFilter( data, type );
+		}
 
 		// The filter can actually parse the response
-		if( typeof data === "string" ){
+		if ( typeof data === "string" ) {
 
 			// If the type is "script", eval it in global context
-			if ( type == "script" )
+			if ( type === "script" ) {
 				jQuery.globalEval( data );
+			}
 
 			// Get the JavaScript object, if JSON is used.
-			if ( type == "json" )
-				data = window["eval"]("(" + data + ")");
+			if ( type == "json" ) {
+				if ( typeof JSON === "object" && JSON.parse ) {
+					data = JSON.parse( data );
+				} else {
+					data = (new Function("return " + data))();
+				}
+			}
 		}
 
 		return data;