3 ms·
The technique of fetching remote content into JavaScript is dangerous. JSON is no more dangerous than any other JS. Executing foreign code with eval is bad. Pa
by Evbn 14y ago
The technique of fetching remote content into JavaScript is dangerous. JSON is no more dangerous than any other JS.
Executing foreign code with eval is bad. Parsing foreign text is not. It was a problem when people misused browsers to conflate them.
- jcampbell1 14y agoThis has nothing to do with executing foreign code with eval. Here is how the the attack was performed. On my site, I rewrite the Array constructor. I then add <script src="http://gmail.com/mycontacts.json"></script> Now you visit my site, and I now have stolen all your Google contacts, which are protected by your google password. You see this has nothing to do with "eval".
- sluu99 14y agoThat's why google starts their json with while(1); (or something like that) so any effort attempting to evaluate the json itself as javascript code will be stuck in an infinite loop.
- ajanuary 14y agoThe problem here is still "the technique of fetching remote content into JavaScript", not json itself.
- tocomment 14y agoI don't understand. Aren't there cross site scripting restrictions?
- Zarel 14y agoXSS restrictions generally apply to things such as making XmlHttpRequests from other sites. Loading scripts from other sites generally isn't restricted, since it's used for a variety of legitimate things such as loading jQuery from a CDN.
- tocomment 14y agoSo how do you prevent this?