5 ms·

just a question - is this any worse than the "JSON-in-script" output method?

• kolodny 13y ago
  Significantly worse. Using the jsonp[1] format is passing a regular javascript object to a global function [1] http://en.wikipedia.org/wiki/JSONP http://en.wikipedia.org/wiki/JSONP
  • bickfordb 13y ago
    It seems that if the attacker controls the source URL, he could eval anything he wanted in any either case?
    • kolodny 13y ago
      While that's true in this case, it's considered a bad practice to eval json to get a javascript object. Most browsers (all modern ones) have a JSON.parse method that will safely evaluate all json strings to js object. The really old browsers have libraries to accomplish this. It seems that this article hasn't been updated in a while by the very fact that the next section is called "JSON-in-script output" and not jsonp, keep in mind this article even has a reference to json.org on the bottom of that page which includes a library to do said function
  • badman_ting 13y ago
    Well, it works that way by convention, sure. But ultimately you're allowing a third party to inject scripts into your page. That's not ever going to be secure.