Yes, this is XSSI and the exploit comes in because a JSON array is essentially treated as "executable" code in some JS implementations. Here are a couple of re

Yes, this is XSSI and the exploit comes in because a JSON array is essentially treated as "executable" code in some JS implementations. Here are a couple of resources that go a litle more into XSSI: Google tech talk: http://www.youtube.com/watch?v=jC6Q1uCnbMo&feature=player_detailpage#t=2306s http://www.youtube.com/watch?v=jC6Q1uCnbMo&feature=playe... Gruyere codelab: http://google-gruyere.appspot.com/part3#3__cross_site_script_inclusion http://google-gruyere.appspot.com/part3#3__cross_site_script...