Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why does Google prepend while(1); to their JSON responses?

stackoverflow.com

Post reply on HN
Print view View original

101–110 of 120 posts

Re: Why does Google prepend while(1); to their JSON responses?

#101

Post by hcs »

Roodgorf wrote: post #96
amenghra wrote: post #84

Earlier quoted context omitted.

If you are browsing the web with a 10 year old browser you are opening yourself up to a ton of security bugs. Whether json responses contain a while loop or not isn't going to make a difference. The reason Google and Facebook keep this kind of stuff around is because it's there and doesn't hurt to keep it. There's a slight chance it will provide some protection if a similar attack vector is discovered.

But aren't you saying this is an already existing attack vector then?? Why try to find a similar one if you knew you could just get an older browser version and use this one? Is that not a good enough reason to be prepared for it?

As sagethesagesage said [1], you're protecting the user from having their browser pass the user's data from your site to a malicious site. The attacker shouldn't be able to make the user run an old, vulnerable browser.

[1] https://news.ycombinator.com/item?id=14282532

Re: Why does Google prepend while(1); to their JSON responses?

#102

Post by int_19h »

amelius wrote: post #64
vesinisa wrote: post #59

Earlier quoted context omitted.

I was commenting to the GP about technologies to replace JavaScript. On the long term WASM is the best candidate, though it's indeed not one of the intended goals of the project. JS will be with us eternally, rest assured. But if DOM-enabled WASM would one day gain wide adoption, developers targeting contemporary browsers of the future would at least have a wider selection of runtimes to choose form in addition to JS…

I can also see it happen that browsers will one day shut down plain JavaScript, only allowing WASM. Certainly if the security burden becomes too big.

Once WASM becomes established, I would expect JS to become "yet another runtime" on it.

Re: Why does Google prepend while(1); to their JSON responses?

#103

Post by aetherson »

wtetzner wrote: post #63
eriknstr wrote: post #25

Earlier quoted context omitted.

Someone had the same question as you in a comment. >Wouldn't returning an object containing the array, instead of the array directly, also solve the problem? And someone else replied >No, that wouldn't solve the problem since the same attacks mentioned in the post could still be performed. Overriding the accessor methods to retrieve the info.

Except I don't think a JSON object is valid Javascript by itself.

What about a JSON object do you think is invalid Javascript?

Re: Why does Google prepend while(1); to their JSON responses?

#104

Post by hdhzy »

kuschku wrote: post #87
hdhzy wrote: post #56

Earlier quoted context omitted.

If the site accepts httpsb it can as well support the Origin header [0] and the problem is solved. [0]: https://wiki.mozilla.org/Security/Origin

The whole point is to allow any site to access any other site, just like plain TCP sockets, without stealing your cookies. If the site wants to access google.com with its own cookies, fine, why not?

Could you elaborate on the "stealing your cookies" part?

Cookies are sent only to the origin that set them and (except XSS attacks) are not revealed to anyone else. So who exactly is stealing them?

Re: Why does Google prepend while(1); to their JSON responses?

#105

Post by jondubois »

ef4 wrote: post #98
trav4225 wrote: post #66

Earlier quoted context omitted.

Yup! In my personal (and basically worthless) opinion, this is why the entire "web application" ecosystem is a giant, flawed mess. It's basically what happens when a system originally designed to represent and transfer rich textual documents (HTML/HTTP) is bastardized into a application architecture. Yes, I'm being somewhat hyperbolic. Bring on the downvotes! ;-)

This kind of criticism misses the point. The web is not designed. It is evolved. Various bits of it were designed at their outset, but it was literally impossible to envision all the implications of those design decisions. This is not a bad thing, for the simple reason that every long-lived complex system involving many humans must behave this way. Any attempt to top-down design the perfect, universal, distributed ap…

Also JavaScript itself was designed to evolve in a backwards-compatible way. The way developers use JavaScript today is quite different from how they used it 10 years ago.

The idea that systems are fixed entities that have to be designed correctly up-front is wrong and is one of the reasons why the Waterfall model of software development has been superseded by Agile.

Good systems have to be designed to handle change. Change is the only constant thing in this world.

Re: Why does Google prepend while(1); to their JSON responses?

#106

Post by kuschku »

hdhzy wrote: post #104
kuschku wrote: post #87

Earlier quoted context omitted.

The whole point is to allow any site to access any other site, just like plain TCP sockets, without stealing your cookies. If the site wants to access google.com with its own cookies, fine, why not?

Could you elaborate on the "stealing your cookies" part? Cookies are sent only to the origin that set them and (except XSS attacks) are not revealed to anyone else. So who exactly is stealing them?

Well, currently, nothing. But currently, the web is completely broken.

If you want web-applications to be powerful, and open, you also need to be able to have any web application to access any URL.

Why should only mail.google.com be able to access my emails, and not also my-little-opensource-webmail.com ?

To faciliate that, without also adding cookie stealing back in, you need to allow any website to open standard TCP sockets.

Re: Why does Google prepend while(1); to their JSON responses?

#108

Post by deathanatos »

aetherson wrote: post #103
wtetzner wrote: post #63

Earlier quoted context omitted.

Except I don't think a JSON object is valid Javascript by itself.

What about a JSON object do you think is invalid Javascript?

While the person you're responding to might genuinely be confused about JSON usually being valid JavaScript, arbitrary JSON isn't guaranteed to be: http://timelessrepo.com/json-isnt-a-javascript-subset

Re: Why does Google prepend while(1); to their JSON responses?

#109

Post by CJefferson »

minitech wrote: post #76
minitech wrote: post #50

Earlier quoted context omitted.

No, that’s not a real risk.

I’m not sure why this is downvoted. No JavaScript engine does that. “This is JavaScript after all” is ridiculous FUD.

I was sure I had used browsers which did that, if I didn't then sorry, I must be hallucinating.

I wouldn't call it FUD, I'm not suggesting don't use JavaScript, and we are already talking in this article about one crazy workaround because of the weirdness of modern jazz development!

The "this is JavaScript after all" referred to JavaScript tending to continue after errors (which it does in some cases, like a bad callback, or a whole file which didn't parse).

Re: Why does Google prepend while(1); to their JSON responses?

#110

Post by [deleted] »

adrianmalacoda wrote: post #92
orf wrote: post #43

Earlier quoted context omitted.

Because it's not about eval(), as the link you're commenting on explains in detail?

If I'm understanding it correctly, though, prepending while(0) or even if(0) to the JSON would prevent the attack, because the JSON object would not actually be executed. I think they were asking if there was any particular reason to prefer the infinite loop over that. The answer that comes to mind for me is that having the script hang is a more obvious failure state than simply skipping over the statement, and makes…

[deleted]
Post reply on HN