First, your sample isn't legal JSON syntax. Suppose it's something like this instead:
var input = '{"status":"oke","fnFeedback":"function (a,b,c){return a+c.FnSource;}"}';
One way to deal with this is to parse normally and then use eval to turn the value of the fnFeedback property into a Function object. However, using eval is usually a last resort (not to mention extremely risky if you aren't in total control of the value being eval-ed) and here there's a better approach using a little trick when parsing JSON data.
The trick is that JSON.parse accepts a second argument, which should be a function that accepts a key/value pair and returns the result. This will be called for every element that is parsed. Here's one that will turn your serialized function string into an actual function:
var result = JSON.parse(input,
function(key, value) {
// if value looks like a function definition, make a function
if (value
&& typeof value === "string"
&& value.substr(0,8) == "function")
{
var startBody = value.indexOf('{') + 1;
var endBody = value.lastIndexOf('}');
var startArgs = value.indexOf('(') + 1;
var endArgs = value.indexOf(')');
return new Function(value.substring(startArgs, endArgs),
value.substring(startBody, endBody));
}
// else just return the value as is
return value;
});
When this is run, you can then see the results:
> result['fnFeedback']
[Function]
> result['fnFeedback'].toString()
'function anonymous(a,b,c) {\n return a+c.FnSource; \n}'
A more detailed explanation of how this works can be found here (from which the above was adapted). Also see this JavaScript gist for another (perhaps cleaner) sample code using the same idea (which I have not tested).
new Function()oreval(bleuch) to turn it into an actual function.eval, both of which make it really easy to exploit your code