3 ms·

Because it's not about eval(), as the link you're commenting on explains in detail?

• adrianmalacoda 10y ago
  If I'm understanding it correctly, though, prepending while(0) or even if(0) to the JSON would prevent the attack, because the JSON object would not actually be executed. I think they were asking if there was any particular reason to prefer the infinite loop over that. The answer that comes to mind for me is that having the script hang is a more obvious failure state than simply skipping over the statement, and makes it more immediate that something has gone wrong.
  • deleted 10y ago
    [deleted]