Protect all uses of JSON.parse against exceptions.

remoting/webapp/host_list.js

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 /**
  * @fileoverview
  * Class representing the host-list portion of the home screen UI.
  */
 
 'use strict';
@@ skipping 31 matching lines @@
    * @private
    */
   this.hosts_ = [];
   /**
    * @type {string}
    * @private
    */
   this.lastError_ = '';
 
   // Load the cache of the last host-list, if present.
-  var cached = /** @type {string} */
+  var cachedStr = /** @type {string} */
       (window.localStorage.getItem(remoting.HostList.HOSTS_KEY));
-  if (cached) {
-    try {
-      this.hosts_ = /** @type {Array} */ JSON.parse(cached);
-    } catch (err) {
-      console.error('Invalid host list cache:', /** @type {*} */(err));
+  if (cachedStr) {
+    var cached = jsonParseSafe(cachedStr);
+    if (cached) {
+      this.hosts_ = /** @type {Array} */ cached;
+    } else {
+      console.error('Invalid value for ' + remoting.HostList.HOSTS_KEY);
     }
   }
 };
 
 /**
  * Search the host list for a host with the specified id.
  *
  * @param {string} hostId The unique id of the host.
  * @return {remoting.Host?} The host, if any.
  */
@@ skipping 45 matching lines @@
  * @param {XMLHttpRequest} xhr The XHR object for the host list request.
  * @param {function(boolean):void} onDone The callback passed to |refresh|.
  * @return {void} Nothing.
  * @private
  */
 remoting.HostList.prototype.parseHostListResponse_ = function(xhr, onDone) {
   this.hosts_ = [];
   this.lastError_ = '';
   try {
     if (xhr.status == 200) {
-      var parsed_response =
-          /** @type {{data: {items: Array}}} */ JSON.parse(xhr.responseText);
-      if (parsed_response.data && parsed_response.data.items) {
-        this.hosts_ = parsed_response.data.items;
+      var response =
+          /** @type {{data: {items: Array}}} */ jsonParseSafe(xhr.responseText);
+      if (response && response.data && response.data.items) {
+        this.hosts_ = response.data.items;
         /**
          * @param {remoting.Host} a
          * @param {remoting.Host} b
          */
         var cmp = function(a, b) {
           if (a.status < b.status) {
             return 1;
           } else if (b.status < a.status) {
             return -1;
           }
           return 0;
         };
         this.hosts_ = /** @type {Array} */ this.hosts_.sort(cmp);
+      } else {
+        console.error('Invalid "hosts" response from server.');
       }
     } else {
       // Some other error.
       console.error('Bad status on host list query: ', xhr);
       if (xhr.status == 403) {
         // The user's account is not enabled for Me2Me, so fail silently.
       } else if (xhr.status >= 400 && xhr.status < 500) {
         // For other errors, tell the user to re-authorize us.
         this.lastError_ = remoting.Error.GENERIC;
       } else if (xhr.status == 503) {
@@ skipping 148 matching lines @@
                               JSON.stringify(this.hosts_));
 }
 
 /**
  * Key name under which Me2Me hosts are cached.
  */
 remoting.HostList.HOSTS_KEY = 'me2me-cached-hosts';
 
 /** @type {remoting.HostList} */
 remoting.hostList = null;