Infinity
and NaN
aren't keywords or anything special, they are just properties on the global object (as is undefined
) and as such can be changed. It's for that reason JSON doesn't include them in the spec -- in essence any true JSON string should have the same result in EcmaScript if you do eval(jsonString)
or JSON.parse(jsonString)
.
If it were allowed then someone could inject code akin to
NaN={valueOf:function(){ do evil }};
Infinity={valueOf:function(){ do evil }};
into a forum (or whatever) and then any json usage on that site could be compromised.