I believe this hack (JSON Hijacking) was discovered by Jeremiah Grossman in 2005[1].<p>It's fascinating to read how he discovered it and how quickly Google responded.<p>[1] - <a href="http://blog.jeremiahgrossman.com/2006/01/advanced-web-attack-techniques-using.html" rel="nofollow">http://blog.jeremiahgrossman.com/2006/01/advanced-web-attack...</a>
I wondered the same thing years ago. I always thought that browsers would have implemented other security measures so that websites avoid doing this.<p>Around 90 something percent of websites I visit don't implement that `for(;;)` or `while(1)` solution.<p>So are we saying that they're vulnerable sites?
I had a hunch that this is to prevent people from including the resource in a script tag - but I always wondered how they'd access the data as a JSON expression on its own should technically be a no-op when interpreted as JS (or so I thought).<p>The overridden array constructor was the missing link.<p>Though couldn't you have it easier by making sure your top-level JSON structure is always an object?<p>As far as I know, while a standalone array expression []; is a valid JS statement, a standalone object expression {}; is not and would produce a syntax error.
I feel like the browser could use the Content-Type header to check whether the response is JSON or actual executable javascript - throwing an error if the former
I haven't worked with JSON like that before. Do JSON parsers properly ignore the stuff Google puts in, or do you have to strip it out before parsing?
Everytime I read about such constructs, it makes me realize, as a regular developer, how complex web application security is and how difficult it is to think about and cover your application against each and every such potential problem.
FB prepends a "for(;;);" which is 1 char shorter than "while(1);", has been the case since 2012/13.<p>Firebug v2 and ChromeTools know how to parse such JSON and ignore that first part. (IE11 and Firefox newer DevTools can't "handle" it aka show just a plain text string)
Jeez, why not live w/o JavaScript?<p>We keep trying to accomodate a defunct language with insoluble problems. Isn't that an error in our thinking processes?<p><a href="https://www.wired.com/2015/11/i-turned-off-javascript-for-a-whole-week-and-it-was-glorious/" rel="nofollow">https://www.wired.com/2015/11/i-turned-off-javascript-for-a-...</a>