Make JSON.parse usage safer (#373)

* Make JSON.parse usage safer

* Fix any type

* Add readResponseJson

* Use readResponseJson

* Additional updates

* Rename files

* Add types

2 files changed, 5 insertions, 2 deletions

diff --git a/ext/js/pages/settings/backup-controller.js b/ext/js/pages/settings/backup-controller.js
index 85803077..c539bdfe 100644
--- a/ext/js/pages/settings/backup-controller.js
+++ b/ext/js/pages/settings/backup-controller.js
@@ -18,6 +18,7 @@
 
 import {Dexie} from '../../../lib/dexie.js';
 import {isObject, log} from '../../core.js';
+import {parseJson} from '../../core/json.js';
 import {OptionsUtil} from '../../data/options-util.js';
 import {ArrayBufferUtil} from '../../data/sandbox/array-buffer-util.js';
 import {querySelectorNotNull} from '../../dom/query-selector.js';
@@ -427,7 +428,8 @@ export class BackupController {
         if (this._optionsUtil === null) { throw new Error('OptionsUtil invalid'); }
 
         const dataString = ArrayBufferUtil.arrayBufferUtf8Decode(await this._readFileArrayBuffer(file));
-        const data = JSON.parse(dataString);
+        /** @type {import('backup-controller').BackupData} */
+        const data = parseJson(dataString);
 
         // Type check
         if (!isObject(data)) {
diff --git a/ext/js/pages/settings/generic-setting-controller.js b/ext/js/pages/settings/generic-setting-controller.js
index 8666614b..8268f563 100644
--- a/ext/js/pages/settings/generic-setting-controller.js
+++ b/ext/js/pages/settings/generic-setting-controller.js
@@ -17,6 +17,7 @@
  */
 
 import {ExtensionError} from '../../core/extension-error.js';
+import {parseJson} from '../../core/json.js';
 import {DocumentUtil} from '../../dom/document-util.js';
 import {DOMDataBinder} from '../../dom/dom-data-binder.js';
 
@@ -265,7 +266,7 @@ export class GenericSettingController {
      */
     _getTransformDataArray(transformRaw) {
         if (typeof transformRaw === 'string') {
-            const transforms = JSON.parse(transformRaw);
+            const transforms = parseJson(transformRaw);
             return Array.isArray(transforms) ? transforms : [transforms];
         }
         return [];