Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why does Google prepend while(1); to their JSON responses?

stackoverflow.com

Post reply on HN
Print view View original

61–70 of 120 posts

Re: Why does Google prepend while(1); to their JSON responses?

#61

Post by scotth »

Lxr wrote: post #14
frik wrote: post #11

FB prepends a "for(;;);" which is 1 char shorter than "while(1);", has been the case since 2012/13. Firebug v2 and ChromeTools know how to parse such JSON and ignore that first part. (IE11 and Firefox newer DevTools can't "handle" it aka show just a plain text string)

Why does it have to be a loop, couldn't you make a reliable syntax error in less than 8 characters?

You can, and Google does. For example:

https://fonts.google.com/metadata/fonts

And here's the code in Angular's $http service for stripping out that string:

https://github.com/angular/angular.js/blob/master/src/ng/htt...

Re: Why does Google prepend while(1); to their JSON responses?

#62

Post by fixermark »

hdhzy wrote: post #28
winteriscoming wrote: post #12

Everytime I read about such constructs, it makes me realize, as a regular developer, how complex web application security is and how difficult it is to think about and cover your application against each and every such potential problem.

Note that these protections are only needed because Google supports every imaginable browser version even outdated ones. You most certainly do not need to do the same. Array and object globals cannot be overridden now (since 2007) for literals [0] and for ambient authority problem with CORS just check the Origin header. [0]: https://johnresig.com/blog/re-securing-json/

> You most certainly do not need to do the same.

... except that those browsers are still out there, so it depends heavily on how much damage someone can do by abusing the data your server can emit whether you need to do the same.

Re: Why does Google prepend while(1); to their JSON responses?

#63

Post by wtetzner »

eriknstr wrote: post #25
xg15 wrote: post #22

I had a hunch that this is to prevent people from including the resource in a script tag - but I always wondered how they'd access the data as a JSON expression on its own should technically be a no-op when interpreted as JS (or so I thought). The overridden array constructor was the missing link. Though couldn't you have it easier by making sure your top-level JSON structure is always an object? As far as I know, wh…

Someone had the same question as you in a comment. >Wouldn't returning an object containing the array, instead of the array directly, also solve the problem? And someone else replied >No, that wouldn't solve the problem since the same attacks mentioned in the post could still be performed. Overriding the accessor methods to retrieve the info.

Except I don't think a JSON object is valid Javascript by itself.

Re: Why does Google prepend while(1); to their JSON responses?

#64

Post by amelius »

vesinisa wrote: post #59
hdhzy wrote: post #53

Earlier quoted context omitted.

Web Assembly is specifically designed not to replace JavaScript [0]. [0]: http://webassembly.org/docs/faq/#is-webassembly-trying-to-re...

I was commenting to the GP about technologies to replace JavaScript. On the long term WASM is the best candidate, though it's indeed not one of the intended goals of the project. JS will be with us eternally, rest assured. But if DOM-enabled WASM would one day gain wide adoption, developers targeting contemporary browsers of the future would at least have a wider selection of runtimes to choose form in addition to JS…

I can also see it happen that browsers will one day shut down plain JavaScript, only allowing WASM. Certainly if the security burden becomes too big.

Re: Why does Google prepend while(1); to their JSON responses?

#65

Post by amelius »

vbezhenar wrote: post #5
samfisher83 wrote: post #3

Why don't browsers strip cookies when they are doing cross domain javascript fetches?

Because that's the way internet works and breaking it means breaking a lot of websites. Web security wasn't thought carefully when web was built, it's just a bunch of dirty hacks around most obvious vulnerabilities.

I guess this is what you get if you let an advertisement company define the web.

Re: Why does Google prepend while(1); to their JSON responses?

#66

Post by trav4225 »

winteriscoming wrote: post #12

Everytime I read about such constructs, it makes me realize, as a regular developer, how complex web application security is and how difficult it is to think about and cover your application against each and every such potential problem.

Yup! In my personal (and basically worthless) opinion, this is why the entire "web application" ecosystem is a giant, flawed mess. It's basically what happens when a system originally designed to represent and transfer rich textual documents (HTML/HTTP) is bastardized into a application architecture.

Yes, I'm being somewhat hyperbolic. Bring on the downvotes! ;-)

Re: Why does Google prepend while(1); to their JSON responses?

#68

Post by ehsankia »

winteriscoming wrote: post #12

Everytime I read about such constructs, it makes me realize, as a regular developer, how complex web application security is and how difficult it is to think about and cover your application against each and every such potential problem.

You're basically letting strangers run code on your computer. That's basically what a "website" is. It is truly impressive to me how we can have something so complex and still manage to somehow keep it (usually) secure.

Re: Why does Google prepend while(1); to their JSON responses?

#69

Post by moron4hire »

ehsankia wrote: post #68
winteriscoming wrote: post #12

Everytime I read about such constructs, it makes me realize, as a regular developer, how complex web application security is and how difficult it is to think about and cover your application against each and every such potential problem.

You're basically letting strangers run code on your computer. That's basically what a "website" is. It is truly impressive to me how we can have something so complex and still manage to somehow keep it (usually) secure.

That's what "software" is, dude.

Re: Why does Google prepend while(1); to their JSON responses?

#70

Post by kevan »

jcoffland wrote: post #32
Lxr wrote: post #14

Earlier quoted context omitted.

Why does it have to be a loop, couldn't you make a reliable syntax error in less than 8 characters?

8 chars is already pretty short. If you're concerned about the length, don't be. A TCP packet is at least 512 bytes.

This is definitely the sort of thing you'd want to gather data on. It's plausible that it could save Terabytes of bandwidth per day at Facebook/Google scale.
Post reply on HN