Why not "while(0)"? Then an eval wouldn't do anything.
Why does Google prepend while(1); to their JSON responses?
41–50 of 120 posts
Re: Why does Google prepend while(1); to their JSON responses?
#42Earlier quoted context omitted.
It would be easy to make sending credentials opt-in in a new HTTP or HTML version. The way it's done now is backwards IMHO. Define httpsb:// do be like https:// , but any site may make ajax and similar requests to it (without credentials). Then make some kind of exception (like csrf protection), or use legacy https, in case you need to send cookies.
But an attacker would simply use https://.." , instead of <script src="httpsb://.." ?
Only if that is supported by the site being attacked. If the site only accepts httpsb connections, then the attacker would not have a way in.
Re: Why does Google prepend while(1); to their JSON responses?
#43Why not "while(0)"? Then an eval wouldn't do anything.
Because it's not about eval(), as the link you're commenting on explains in detail?
Re: Why does Google prepend while(1); to their JSON responses?
#44Earlier quoted context omitted.
Isn't that what Safari does with the "Allow from current website only" setting? It defaults to "Allow from websites I visit", which means that only embedded content from sites you've visited before get their cookies, not random new embeds)
Interesting. Dos that mean that trackers like doubkeclick don't work on Safari with the default settings?
Wasn't a while ago news that advertisers were using a hack to bypass this protection in safari, and that caused a bit of uproar?
Re: Why does Google prepend while(1); to their JSON responses?
#45Everytime I read about such constructs, it makes me realize, as a regular developer, how complex web application security is and how difficult it is to think about and cover your application against each and every such potential problem.
Modern web development is already hard by itself, specially when it comes to security. A saner runtime language is needed to replace the sub par standard that is javascript. One with a robust type-system and coherent semantics. It won't fix every problem, but a least it would prevent abuses such as the one in question.
WASM (WebAssembly) is about developing a very simple cross-browser bytecode that allows implementing any runtime on top of it. The first versions are already rolling out in latest major browser versions, but at this stage you don't yet get DOM access from WASM. After the initial phase when DOM access is implemented, it's the beginning of end for JavaScript. Future browsers might well implement JS as a pre-shipped runtime targeting the internal WASM core.
Re: Why does Google prepend while(1); to their JSON responses?
#46Why don't browsers strip cookies when they are doing cross domain javascript fetches?
I'd say it's because of advertising mostly, but a lot of similar tech (that is usually ad supported) like Disqus. It's interesting that today cross-domain sandboxing applies to almost everything except JavaScript. If I load an image cross domain and draw it into a canvas, the contents of that canvas are sandboxes, but I can cheerfully mix and match code across domains too. Seems like it would be a good thing to do bu…
Having advertisers not tracking you seems like a benefit not a con.
Re: Why does Google prepend while(1); to their JSON responses?
#47Jeez, why not live w/o JavaScript?
We keep trying to accomodate a defunct language with insoluble problems. Isn't that an error in our thinking processes?
https://www.wired.com/2015/11/i-turned-off-javascript-for-a-...
Re: Why does Google prepend while(1); to their JSON responses?
#48Earlier quoted context omitted.
Because that's the way internet works and breaking it means breaking a lot of websites. Web security wasn't thought carefully when web was built, it's just a bunch of dirty hacks around most obvious vulnerabilities.
It would be easy to make sending credentials opt-in in a new HTTP or HTML version. The way it's done now is backwards IMHO. Define httpsb:// do be like https:// , but any site may make ajax and similar requests to it (without credentials). Then make some kind of exception (like csrf protection), or use legacy https, in case you need to send cookies.
I proposed a header instead of a protocol btw
https://medium.com/@homakov/request-for-a-new-header-state-o...
Re: Why does Google prepend while(1); to their JSON responses?
#49I wondered the same thing years ago. I always thought that browsers would have implemented other security measures so that websites avoid doing this. Around 90 something percent of websites I visit don't implement that `for(;;)` or `while(1)` solution. So are we saying that they're vulnerable sites?
No, they’re not vulnerable; browsers fixed this bug a long time ago.
Re: Why does Google prepend while(1); to their JSON responses?
#50Earlier quoted context omitted.
Why does it have to be a loop, couldn't you make a reliable syntax error in less than 8 characters?
The risk there is some parsers might carry on past the syntax error and try to continue parsing. This is JavaScript after all.
No, that’s not a real risk.