3 ms·
This has nothing to do with executing foreign code with eval. Here is how the the attack was performed. On my site, I rewrite the Array constructor. I then a
by jcampbell1 14y ago
This has nothing to do with executing foreign code with eval.
Here is how the the attack was performed. On my site, I rewrite the Array constructor. I then add
<script src="http://gmail.com/mycontacts.json"></script>
Now you visit my site, and I now have stolen all your Google contacts, which are protected by your google password.
You see this has nothing to do with "eval".
- sluu99 14y agoThat's why google starts their json with while(1); (or something like that) so any effort attempting to evaluate the json itself as javascript code will be stuck in an infinite loop.
- ajanuary 14y agoThe problem here is still "the technique of fetching remote content into JavaScript", not json itself.
- tocomment 14y agoI don't understand. Aren't there cross site scripting restrictions?
- Zarel 14y agoXSS restrictions generally apply to things such as making XmlHttpRequests from other sites. Loading scripts from other sites generally isn't restricted, since it's used for a variety of legitimate things such as loading jQuery from a CDN.
- tocomment 14y agoSo how do you prevent this?