3 ms·
I wondered the same thing years ago. I always thought that browsers would have implemented other security measures so that websites avoid doing this. Around 90
by westoque 9y ago
I wondered the same thing years ago. I always thought that browsers would have implemented other security measures so that websites avoid doing this.
Around 90 something percent of websites I visit don't implement that `for(;;)` or `while(1)` solution.
So are we saying that they're vulnerable sites?
- deleted 9y ago[deleted]
- Lxr 9y agoThe root object has to be an array I believe.
- coldtea 9y ago>So are we saying that they're vulnerable sites? We are saying that they're vulnerable for THAT particular issue (the JSON hijacking), and that is only if they don't already have some other way of dealing with it.
- raulk 9y ago> So are we saying that they're vulnerable sites? Not necessarily, if all their API responses are top-level JSON objects.
- minitech 9y agoNo, they’re not vulnerable; browsers fixed this bug a long time ago.