Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why does Google prepend while(1); to their JSON responses?

stackoverflow.com

Post reply on HN
Print view View original

111–120 of 120 posts

Re: Why does Google prepend while(1); to their JSON responses?

#111

Post by wtetzner »

aetherson wrote: post #103
wtetzner wrote: post #63

Earlier quoted context omitted.

Except I don't think a JSON object is valid Javascript by itself.

What about a JSON object do you think is invalid Javascript?

It's a valid subset of Javascript (or at least was initially meant to be), but a JSON object (as opposed to an array) isn't a valid stand-alone Javascript expression, and an attempt to eval it will return an error:

    > eval('{"key": "value"}');
    SyntaxError: missing ; before statement
You can get around this by using parens:

    > eval('({"key": "value"})');
    Object { key: "value" }
But accidentally including a JSON URL in a script tag should fail to evaluate if there's an object at the top level.

Re: Why does Google prepend while(1); to their JSON responses?

#112

Post by kylebebak »

trav4225 wrote: post #66
winteriscoming wrote: post #12

Everytime I read about such constructs, it makes me realize, as a regular developer, how complex web application security is and how difficult it is to think about and cover your application against each and every such potential problem.

Yup! In my personal (and basically worthless) opinion, this is why the entire "web application" ecosystem is a giant, flawed mess. It's basically what happens when a system originally designed to represent and transfer rich textual documents (HTML/HTTP) is bastardized into a application architecture. Yes, I'm being somewhat hyperbolic. Bring on the downvotes! ;-)

I like to think web browsers take the worse is better approach to security.

Security takes a back seat to reproductive fitness of the web as a platform. JS made the web insecure, but it also made it the world's premier application platform.

I blogged about this: http://kylebebak.github.io/post/browser-security-worse-is-be...

Re: Why does Google prepend while(1); to their JSON responses?

#113

Post by kylebebak »

extrapickles wrote: post #15
samfisher83 wrote: post #3

Why don't browsers strip cookies when they are doing cross domain javascript fetches?

There is a newish cookie flag called samesite to do exactly this. Chrome is the only browser to support it though.

I read about this recently. It's hard to believe these cookies didn't exist until 2016.

The biggest problem solved by cookies has always been sessions. samesite is sufficient for most sessions. It seems like samesite should have been the default from the beginning.

Re: Why does Google prepend while(1); to their JSON responses?

#114

Post by missblit »

krapp wrote: post #80
oblio wrote: post #73

Earlier quoted context omitted.

On the other hand, if you thought modern browsers are bloated, just wait for everyone to compile their runtimes on top of WASM. It's not very hard to imagine, especially in an enteprise environment, running a browser 15-20 years from now and that browser loading the equivalent of the JVM, .NET CLR, Ruby VM, etc., on top of WASM :)

15-20 years from now, it's likely that "browser" will just be the operating system.

This actually reminds me of "es-operating-system"; an experimental operating system copyrighted by Nintendo (yes, Nintendo!), where "every system API is defined in Web IDL".

AFAIK it never went anywhere, but maybe building an entirely new OS/Browser based around WebIDL seemed less insane 10 years ago.

https://code.google.com/archive/p/es-operating-system/

Re: Why does Google prepend while(1); to their JSON responses?

#115

Post by minitech »

CJefferson wrote: post #109
minitech wrote: post #76

Earlier quoted context omitted.

I’m not sure why this is downvoted. No JavaScript engine does that. “This is JavaScript after all” is ridiculous FUD.

I was sure I had used browsers which did that, if I didn't then sorry, I must be hallucinating. I wouldn't call it FUD, I'm not suggesting don't use JavaScript, and we are already talking in this article about one crazy workaround because of the weirdness of modern jazz development! The "this is JavaScript after all" referred to JavaScript tending to continue after errors (which it does in some cases, like a bad call…

> one crazy workaround because of the weirdness of modern jazz development

Autocorrect of “JS”? If so: it’s not a modern weirdness; this is an old, long-fixed browser bug.

FWIW, JavaScript continues executing after errors in cases where it makes sense. If an event listener throws an error, it doesn’t make much sense for it to stop all future events without crashing the page (which is kind of what IE used to do with its script error message box, and we know how that turned out).

Re: Why does Google prepend while(1); to their JSON responses?

#116

Post by minitech »

xg15 wrote: post #22

I had a hunch that this is to prevent people from including the resource in a script tag - but I always wondered how they'd access the data as a JSON expression on its own should technically be a no-op when interpreted as JS (or so I thought). The overridden array constructor was the missing link. Though couldn't you have it easier by making sure your top-level JSON structure is always an object? As far as I know, wh…

> Though couldn't you have it easier by making sure your top-level JSON structure is always an object?

Yes, this works too. You’re correct about any keys causing a syntax error.

Re: Why does Google prepend while(1); to their JSON responses?

#117

Post by lenkite »

ef4 wrote: post #98
trav4225 wrote: post #66

Earlier quoted context omitted.

Yup! In my personal (and basically worthless) opinion, this is why the entire "web application" ecosystem is a giant, flawed mess. It's basically what happens when a system originally designed to represent and transfer rich textual documents (HTML/HTTP) is bastardized into a application architecture. Yes, I'm being somewhat hyperbolic. Bring on the downvotes! ;-)

This kind of criticism misses the point. The web is not designed. It is evolved. Various bits of it were designed at their outset, but it was literally impossible to envision all the implications of those design decisions. This is not a bad thing, for the simple reason that every long-lived complex system involving many humans must behave this way. Any attempt to top-down design the perfect, universal, distributed ap…

Evolution at-least has mass extinction events. Lets hope that Web 2.0, which resembles a gigantic, evolved Kraken filled with various protuberances analogous to the large intestine appendix, suffers from one sometime in the future.

Re: Why does Google prepend while(1); to their JSON responses?

#118

Post by xg15 »

aetherson wrote: post #103
wtetzner wrote: post #63

Earlier quoted context omitted.

Except I don't think a JSON object is valid Javascript by itself.

What about a JSON object do you think is invalid Javascript?

All JSON literals are valid JS expressions but not all are valid statements. The two are different parts of the JS grammar.

As script blocks expect one or more statements to execute, the hack relies on the fact that some JSON (array literals) also happen to be valid statements in addition to expressions.

Re: Why does Google prepend while(1); to their JSON responses?

#119

Post by softawre »

moron4hire wrote: post #69
ehsankia wrote: post #68

Earlier quoted context omitted.

You're basically letting strangers run code on your computer. That's basically what a "website" is. It is truly impressive to me how we can have something so complex and still manage to somehow keep it (usually) secure.

That's what "software" is, dude.

Can I hire you to make quips like this during meetings when people say the most obvious shit?

Re: Why does Google prepend while(1); to their JSON responses?

#120

Post by homakov »

hdhzy wrote: post #58
homakov wrote: post #48

Earlier quoted context omitted.

I proposed a header instead of a protocol btw https://medium.com/@homakov/request-for-a-new-header-state-o...

Sounds good but I suspect it will meet the same fate as XHTML 2: designed to be clean and perfect but in reality it would take to much effort to implement and maintain. From your professional experience you can probably tell people would rather have slightly insecure site that works and gives profits rather than broken one because SOTA started including some new feature you didn't know... People would rather enable t…

> SOTA started including some new feature you didn't know

if you sign for 2 versions, changes in 3 would not brake you. and the point is MANY things right now could be safe to turn on for 99.99%, e.g. XFO. So, not much effort

Post reply on HN