Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why does Google prepend while(1); to their JSON responses?

stackoverflow.com

Post reply on HN
Print view View original

21–30 of 120 posts

Re: Why does Google prepend while(1); to their JSON responses?

#21

Post by coldtea »

Lxr wrote: post #14
frik wrote: post #11

FB prepends a "for(;;);" which is 1 char shorter than "while(1);", has been the case since 2012/13. Firebug v2 and ChromeTools know how to parse such JSON and ignore that first part. (IE11 and Firefox newer DevTools can't "handle" it aka show just a plain text string)

Why does it have to be a loop, couldn't you make a reliable syntax error in less than 8 characters?

The offending website could have error handling to catch and discard the syntax error (e.g. global uncaught exception handler). They wont be able to read the JSON, but otherwise they'd be OK.

But getting hit with this, they would be actively hurt, and I don't think that interpreter session would be able to recover.

Re: Why does Google prepend while(1); to their JSON responses?

#22

Post by xg15 »

I had a hunch that this is to prevent people from including the resource in a script tag - but I always wondered how they'd access the data as a JSON expression on its own should technically be a no-op when interpreted as JS (or so I thought).

The overridden array constructor was the missing link.

Though couldn't you have it easier by making sure your top-level JSON structure is always an object?

As far as I know, while a standalone array expression []; is a valid JS statement, a standalone object expression {}; is not and would produce a syntax error.

Re: Why does Google prepend while(1); to their JSON responses?

#23

Post by 0x0 »

captainmuon wrote: post #18
vbezhenar wrote: post #5

Earlier quoted context omitted.

Because that's the way internet works and breaking it means breaking a lot of websites. Web security wasn't thought carefully when web was built, it's just a bunch of dirty hacks around most obvious vulnerabilities.

It would be easy to make sending credentials opt-in in a new HTTP or HTML version. The way it's done now is backwards IMHO. Define httpsb:// do be like https:// , but any site may make ajax and similar requests to it (without credentials). Then make some kind of exception (like csrf protection), or use legacy https, in case you need to send cookies.

But an attacker would simply use https://..", instead of <script src="httpsb://.." ?

Re: Why does Google prepend while(1); to their JSON responses?

#24

Post by Lxr »

xg15 wrote: post #22

I had a hunch that this is to prevent people from including the resource in a script tag - but I always wondered how they'd access the data as a JSON expression on its own should technically be a no-op when interpreted as JS (or so I thought). The overridden array constructor was the missing link. Though couldn't you have it easier by making sure your top-level JSON structure is always an object? As far as I know, wh…

.NET does this by wrapping things with {'d': data}, I always thought this was the reason.

Re: Why does Google prepend while(1); to their JSON responses?

#25

Post by eriknstr »

xg15 wrote: post #22

I had a hunch that this is to prevent people from including the resource in a script tag - but I always wondered how they'd access the data as a JSON expression on its own should technically be a no-op when interpreted as JS (or so I thought). The overridden array constructor was the missing link. Though couldn't you have it easier by making sure your top-level JSON structure is always an object? As far as I know, wh…

Someone had the same question as you in a comment.

>Wouldn't returning an object containing the array, instead of the array directly, also solve the problem?

And someone else replied

>No, that wouldn't solve the problem since the same attacks mentioned in the post could still be performed. Overriding the accessor methods to retrieve the info.

Re: Why does Google prepend while(1); to their JSON responses?

#26

Post by raulk »

westoque wrote: post #13

I wondered the same thing years ago. I always thought that browsers would have implemented other security measures so that websites avoid doing this. Around 90 something percent of websites I visit don't implement that `for(;;)` or `while(1)` solution. So are we saying that they're vulnerable sites?

> So are we saying that they're vulnerable sites?

Not necessarily, if all their API responses are top-level JSON objects.

Re: Why does Google prepend while(1); to their JSON responses?

#28

Post by hdhzy »

winteriscoming wrote: post #12

Everytime I read about such constructs, it makes me realize, as a regular developer, how complex web application security is and how difficult it is to think about and cover your application against each and every such potential problem.

Note that these protections are only needed because Google supports every imaginable browser version even outdated ones. You most certainly do not need to do the same.

Array and object globals cannot be overridden now (since 2007) for literals [0] and for ambient authority problem with CORS just check the Origin header.

[0]: https://johnresig.com/blog/re-securing-json/

Post reply on HN