I made a post few months ago regarding this exact vulnerability: https://dev.to/antogarand/why-facebooks-api-starts-with-a-for-loop-1eob https://dev.to/antogara

I made a post few months ago regarding this exact vulnerability: https://dev.to/antogarand/why-facebooks-api-starts-with-a-for-loop-1eob https://dev.to/antogarand/why-facebooks-api-starts-with-a-fo... HN discussion: https://news.ycombinator.com/item?id=18443125 https://news.ycombinator.com/item?id=18443125 --- While this vulnerability is getting old, it's very interesting to see its prevention still in effect on major websites. Even if the original vulnerability is patched, we never know when a modern variant might pop out, such as using UTF16BE as charset to extract array data!