[scottlamb]

Interestingly, ECMA-404 says the following:

> The goal of this specification is only to define the syntax of valid JSON texts. Its intent is not to provide any semantics or interpretation of text conforming to that syntax.

So it is legal JSON although not useful with a lot of concrete implementations. Maybe a way to find an exciting security vulnerability involving two parsers differing in their interpretation...

[ADD-SP]

Perhaps checking a service's behavior in response to such JSON is high on the security researcher's list of things to do that are high priority and simple.

"( – ⌓ – )