I'm writing some AJAX; the server returns JSON (that I also wrote, and as such is sanitary JSON). Under these conditions it seems I can use eval just fine, however I worry that there may be some sort of man in the middle attack on my clients, substituting their JSON for mine. I suppose if there is a man in the middle, they can just as easily substitute their own javascript files as they can change my JSON...
So I guess if anyone can confirm I'm right, that so long as I can trust the server's JSON I can trust the JSON (and thus use eval), then that'd be nice.