Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Simple Way to Extract GET Params from a JavaScript Script Tag

loopj.com

Post reply on HN
Print view View original

11–20 of 26 posts

Re: Simple Way to Extract GET Params from a JavaScript Script Tag

#11

Post by patio11 »

melvin wrote: post #5

I was seeking to avoid the same thing recently. Instead of adding more JavaScript, I decided to use PHP. While we're using Rails, it's very inefficient to fire up the whole engine to do something as simple as outputting a script with a few interpolated variables. A simple PHP script can put out 2-3 times as many requests per second as Rails/Django for a task like that.

Rack Metal was pretty much made for that. I wouldn't use either until I had evidence that it was a bottleneck, but if you do, then it would let you do a few simple requests quickly without needing to swap stacks. (I run PHP and Rails concurrently for one application, but only because I had to be able to get Wordpress working.)

Re: Simple Way to Extract GET Params from a JavaScript Script Tag

#13

Post by Sephr »

This fails if you can't control the filename of the script being hosted. You can get around said flaw by utlizing the magic of errors™ as demonstrated in this example function I have made:

    var getErrorLocation = function (error) {
        var loc, replacer = function (stack, matchedLoc) {
            loc = matchedLoc;
        };
    
        if ("fileName" in error) {
            loc = error.fileName;
        } else if ("stacktrace" in error) { // Opera
            error.stacktrace.replace(/Line \d+ of .+ script (.*)/gm, replacer);
        } else if ("stack" in error) { // WebKit
            error.stack.replace(/at (.*)/gm, replacer);
            loc = loc.replace(/:\d+:\d+$/, ""); // remove line number
        }
        
        return loc;
    };
You could use it as such:

    try {
        0();
    } catch (e) {
        var scriptLocation = getErrorLocation(e);
    }
In SpiderMonkey and Rhino, the Error constructor itself is magic too, so you could just do getErrorLocation(new Error) instead.

Re: Simple Way to Extract GET Params from a JavaScript Script Tag

#15

Post by grez »

geocar wrote: post #8

Here's a simpler way. Put this in your htaccess file: AddHandler server-parsed .js then add: (function(query_string){ ... })(" "); around your script. This obviously has problems with caching, but it doesn't have the problems addressed with those "heavy loads" that you have with PHP et al.

Holy XSS injection, Batman!

Re: Simple Way to Extract GET Params from a JavaScript Script Tag

#18

Post by sesqu »

enomar wrote: post #12

This solution fails when you need to insert the script more than once in a page. Instead, browsers really should provide scripts a means to retrieve the script element that they belong to.

A comment on the article pointed out that since javascript execution is blocking, you can do that for synchronous javascript:

  scripts=document.elements.getElementByTagName('script')
  latest=scripts[scripts.length-1]

Re: Simple Way to Extract GET Params from a JavaScript Script Tag

#19

Post by jauco »

sesqu wrote: post #18
enomar wrote: post #12

This solution fails when you need to insert the script more than once in a page. Instead, browsers really should provide scripts a means to retrieve the script element that they belong to.

A comment on the article pointed out that since javascript execution is blocking, you can do that for synchronous javascript: scripts=document.elements.getElementByTagName('script') latest=scripts[scripts.length-1]

I wrote a small jQuery plugin around that idea ( at https://gist.github.com/435668/85466138a24814baef3ec6a73b7cc... )

This approach allows you to specify parameters as JSON. So data of arbitrary length can be passed without having to resort to some global variable.

It solves a problem I had where I needed to pass some template engine generated content into an otherwise static script.

Thanks for the tip :)

Post reply on HN