Is there any XSS threat while having JSON encoded in the URL?
A threat of this kind comes from using different methods of decoding JSON, namely eval and new Function. These execute JS code directly and therefore allow non-persistent XSS attacks by putting code in the url (and linking to it).
JSON.parse does not have this issue and is safe against these kind of attacks.
Does label end up getting inserted into the DOM somewhere? (IE, $('#something').html(context.attr1.target_id-0.label))
Then I could put <script>...</script> in a label and there's your XSS.
I dont see any threat in it. Its completely safe. JSON.parse does not allow any function to run.
Also, why using ? . If you want to give a feel of 'real' url, use hashbang instead.