9 ms·
Why does Google prepend while(1); to their JSON responses? (2010)
- deleted 8y ago[deleted]
- gtirloni 8y agoDiscussed a few times here: https://hn.algolia.com/?query=google%20prepend%20while(1) https://hn.algolia.com/?query=google%20prepend%20while(1)
- chupa-chups 8y agoSorry, didn't notice :( This time i relied on HN's mechanism to automatically redirect one to old posts with the same URL. Usually i check.
- a-wu 8y agoWell I'm one of today's 10,000[0] so thanks for posting anyway! [0] https://www.xkcd.com/1053/ https://www.xkcd.com/1053/
- dang 8y agoAfter a year or so we no longer count it as a dupe. This is in the FAQ: https://news.ycombinator.com/newsfaq.html https://news.ycombinator.com/newsfaq.html.
- gtirloni 8y agoNo worries. I only mentioned that because there's more history in those other threads that people might want to check. I didn't mean to say you shouldn't have posted, quite the contrary, thanks for posting it :)
- ramshorns 8y agoSomething I just learned about JavaScript: the semicolon is an empty statement, so this is an infinite loop that does nothing.
- ygra 8y agoJavaScript shares this trait with a lot of languages that borrow syntax from C.
- gravypod 8y agoA good example of this is a simple strcpy in C: while (a++ = b++);
- TheSoftwareGuy 8y agoI was gonna say you need a dereference operator in there somewhere, but based on that itslicized ‘a’, i think HNs markdown formatting turned them into italics
- deleted 8y ago[deleted]
- umanwizard 8y agoCorrect version (not broken by formatting): while (*a++ = *b++);
- amelius 8y agoHow did you manage to enter it in HN? Is there an escape sequence for asterisk? Or are you using special Unicode codepoints?
- umanwizard 8y agoDouble space at the beginning of a line makes that line verbatim (and monospaced). https://news.ycombinator.com/formatdoc https://news.ycombinator.com/formatdoc
- ec109685 8y agoThis isn’t needed for browsers newer than 2011: https://stackoverflow.com/questions/16289894/is-json-hijacking-still-an-issue-in-modern-browsers https://stackoverflow.com/questions/16289894/is-json-hijacki...
- detaro 8y agoFrom a link on that page, various variations that worked in newer browsers: https://portswigger.net/blog/json-hijacking-for-the-modern-web https://portswigger.net/blog/json-hijacking-for-the-modern-w...
- gravypod 8y agoIs this still needed with CORS?
- AntonyGarand 8y agoIt is for older browser which do not support CORS, as well as different variants such as using a script with the UTF16BE charset: https://portswigger.net/blog/json-hijacking-for-the-modern-web https://portswigger.net/blog/json-hijacking-for-the-modern-w...
- robocat 8y agohttp://www.tomanthony.co.uk/blog/facebook-bug-confirm-user-identities/ http://www.tomanthony.co.uk/blog/facebook-bug-confirm-user-i... Mentions how inconsistent usage of the XSSI prevention caused a information leak that could detect which user was logged into Facebook - received a bug bounty of $1000 from Facebook. Previous discussion: https://news.ycombinator.com/item?id=19306309 https://news.ycombinator.com/item?id=19306309
- rayiner 8y ago> Contrived example: say Google has a URL like mail.google.com/json?action=inbox which returns the first 50 messages of your inbox in JSON format. Evil websites on other domains can't make AJAX requests to get this data due to the same-origin policy, but they can include the URL via a <script> tag. The URL is visited with your cookies, and by overriding the global array constructor or accessor methods they can have a method called whenever an object (array or hash) attribute is set, allowing them to read the JSON content. What an absolutely ridiculous language and platform we decided to base the whole web on.
- jobigoud 8y agoIf they are that motivated wouldn't they catch the trick soon enough and remove it from the response?
- Jare 8y agoThe idea is that your browser is running their site, and their site is trying to be malicious and steal your data for a remote site. Your data there can only be accessed with your cookies/auth, so they can't just do it by themselves, they need your computer/browser. If they try to request the json via XHR, CORS will deny it. If they try to read it using a <script> tag, they can't access the response before the response runs as a script and hangs at the infinite loop.
- posterboy 8y agoThe catch is that attackers can redefine accessor methods globaly, because those are part of the object system, and do run modified on load, but they cannot redefine "while", which is a built-in, one of the few reserved language key words. At least I hope they can't. Of course that does depend on implementation details.
- robocat 8y ago> What an absolutely ridiculous language and platform we decided to base the whole web on. JavaScript is used for its virtues, and its flaws can be mitigated. Other languages might not have those flaws, but they have other downsides. It's not like English is the best choice for language either!
- amenghra 8y agoIt protected against a weird javascript edge case in the distant past and against flash injection in the past. See also https://stackoverflow.com/questions/15306636/why-do-facebooks-jsonp-callbacks-start-with https://stackoverflow.com/questions/15306636/why-do-facebook...
- AntonyGarand 8y agoI made a post few months ago regarding this exact vulnerability: https://dev.to/antogarand/why-facebooks-api-starts-with-a-for-loop-1eob https://dev.to/antogarand/why-facebooks-api-starts-with-a-fo... HN discussion: https://news.ycombinator.com/item?id=18443125 https://news.ycombinator.com/item?id=18443125 --- While this vulnerability is getting old, it's very interesting to see its prevention still in effect on major websites. Even if the original vulnerability is patched, we never know when a modern variant might pop out, such as using UTF16BE as charset to extract array data!
- dang 8y ago2017: https://news.ycombinator.com/item?id=14280625 https://news.ycombinator.com/item?id=14280625 2013: https://news.ycombinator.com/item?id=6982205 https://news.ycombinator.com/item?id=6982205
- Sephr 8y agoI created a UTF-7 JSON hijacking method back in 2010 that enabled full hijack of entire JSON data streams in Firefox and Safari: https://www.reddit.com/r/programming/comments/b7ebd/json_sniffing_with_utf7_injections_will_only_work/ https://www.reddit.com/r/programming/comments/b7ebd/json_sni... Originally at https://code.eligrey.com/sec/json-hijacking https://code.eligrey.com/sec/json-hijacking (archive: https://web.archive.org/web/20100304213300/http://code.eligrey.com/poc/json-hijacking/ https://web.archive.org/web/20100304213300/http://code.eligr...)
- spockz 8y agoI thought this kind of protection was only necessary when using arrays on top-level json. Can nested arrays still be obtained somehow when not using this (or other) prefix?
- asimpletune 8y agoThis reminds me of the arguments that the folks at n-gate make over why they won’t use https. Basically, “it’s not me, your client is broken”. There are too many conflicts on interest to fix the broken client.