Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why does Google prepend while(1); to their JSON responses?

stackoverflow.com

Post reply on HN
Print view View original

91–100 of 120 posts

Re: Why does Google prepend while(1); to their JSON responses?

#91

Post by rodorgas »

Tloewald wrote: post #77
samfisher83 wrote: post #46

Earlier quoted context omitted.

Having advertisers not tracking you seems like a benefit not a con.

I agree, but of the four major browsers, two are directly underwritten by advertising (Chrome and Mozilla) and Microsoft is moving that way. Only Apple has backed off advertising as a revenue source, so it basically comes down to Apple being willing to cause massive breakage (the way it did with Flash) in pursuit of a principle. The fact that they enabled ad blockers in mobile safari says they are at least sympatheti…

Did you mean Mozilla is an ad driven company?

Re: Why does Google prepend while(1); to their JSON responses?

#92

Post by adrianmalacoda »

orf wrote: post #43
Animats wrote: post #41

Why not "while(0)"? Then an eval wouldn't do anything.

Because it's not about eval(), as the link you're commenting on explains in detail?

If I'm understanding it correctly, though, prepending while(0) or even if(0) to the JSON would prevent the attack, because the JSON object would not actually be executed. I think they were asking if there was any particular reason to prefer the infinite loop over that.

The answer that comes to mind for me is that having the script hang is a more obvious failure state than simply skipping over the statement, and makes it more immediate that something has gone wrong.

Re: Why does Google prepend while(1); to their JSON responses?

#93

Post by ubernostrum »

samfisher83 wrote: post #3

Why don't browsers strip cookies when they are doing cross domain javascript fetches?

Because then they end up with a bug in how they do it, and oops.

When developing web applications, you must approach this from the perspective of "what is the oldest, least-secure, most bug-riddled pile of C++ and plugins someone could try to hit this with".

If you want an example of why this has to be the approach, well... six years ago the Django security team got an email from the Rails security team. Turned out something we'd both done in our CSRF protection systems didn't actually work. Protecting against CSRF while allowing XMLHttpRequest (remember this is 2011!) is kind of tricky, and the standard approach was one adopted by a lot of JavaScript toolkits: they'd set a consistent custom header (X-Requested-With) on the request. And since browsers only allowed that to be done on requests which obeyed the same-origin sandbox, it was reliable: you knew if you saw that header, it was an XMLHttpRequest that a browser had vetted for same-origin safety (or that it was someone faking a request outside of a browser, but that's not a CSRF vector).

And then it turned out that thanks to a bug in Flash plus the way browsers handled a certain obscure HTTP status code, you could actually set that header on a request to any domain. Oops, that's a complete CSRF bypass in Rails, Django and I don't even remember how many other things.

That's how we learned that particular lesson about trusting browsers to do the right thing, and I don't see myself ever trusting browser security like that again.

Re: Why does Google prepend while(1); to their JSON responses?

#94

Post by [deleted] »

oblio wrote: post #72
amelius wrote: post #64

Earlier quoted context omitted.

I can also see it happen that browsers will one day shut down plain JavaScript, only allowing WASM. Certainly if the security burden becomes too big.

That's awfully optimistic of you. First of all browsers are committed to backwards compatibility. Secondly, there's huge amounts of Javascript written right now, nobody's going to throw away billions of dollars worth of investments. People complain about Cobol written in the 60's, when the programmers counted in the thousands. Javacript today is written by millions of programmers. And thirdly, Javascript evolves, as…

[deleted]

Re: Why does Google prepend while(1); to their JSON responses?

#95

Post by TheAceOfHearts »

trav4225 wrote: post #66
winteriscoming wrote: post #12

Everytime I read about such constructs, it makes me realize, as a regular developer, how complex web application security is and how difficult it is to think about and cover your application against each and every such potential problem.

Yup! In my personal (and basically worthless) opinion, this is why the entire "web application" ecosystem is a giant, flawed mess. It's basically what happens when a system originally designed to represent and transfer rich textual documents (HTML/HTTP) is bastardized into a application architecture. Yes, I'm being somewhat hyperbolic. Bring on the downvotes! ;-)

This problem isn't limited to web applications. Think about how many security problems happen on the server.

All sufficiently complex ecosystems are a giant, flawed mess.

Re: Why does Google prepend while(1); to their JSON responses?

#96

Post by Roodgorf »

amenghra wrote: post #84
fixermark wrote: post #62

Earlier quoted context omitted.

> You most certainly do not need to do the same. ... except that those browsers are still out there, so it depends heavily on how much damage someone can do by abusing the data your server can emit whether you need to do the same.

If you are browsing the web with a 10 year old browser you are opening yourself up to a ton of security bugs. Whether json responses contain a while loop or not isn't going to make a difference. The reason Google and Facebook keep this kind of stuff around is because it's there and doesn't hurt to keep it. There's a slight chance it will provide some protection if a similar attack vector is discovered.

But aren't you saying this is an already existing attack vector then?? Why try to find a similar one if you knew you could just get an older browser version and use this one? Is that not a good enough reason to be prepared for it?

Re: Why does Google prepend while(1); to their JSON responses?

#97

Post by gavinpc »

goatlover wrote: post #89
oblio wrote: post #73

Earlier quoted context omitted.

On the other hand, if you thought modern browsers are bloated, just wait for everyone to compile their runtimes on top of WASM. It's not very hard to imagine, especially in an enteprise environment, running a browser 15-20 years from now and that browser loading the equivalent of the JVM, .NET CLR, Ruby VM, etc., on top of WASM :)

We'll all have gigabit connections by then. So even though it'll be 100 mb of bloat, it will still load the same as today ;)

Yes but they'll be pwned by the FCC (and friends). Don't count on it.

Re: Why does Google prepend while(1); to their JSON responses?

#98

Post by ef4 »

trav4225 wrote: post #66
winteriscoming wrote: post #12

Everytime I read about such constructs, it makes me realize, as a regular developer, how complex web application security is and how difficult it is to think about and cover your application against each and every such potential problem.

Yup! In my personal (and basically worthless) opinion, this is why the entire "web application" ecosystem is a giant, flawed mess. It's basically what happens when a system originally designed to represent and transfer rich textual documents (HTML/HTTP) is bastardized into a application architecture. Yes, I'm being somewhat hyperbolic. Bring on the downvotes! ;-)

This kind of criticism misses the point. The web is not designed. It is evolved. Various bits of it were designed at their outset, but it was literally impossible to envision all the implications of those design decisions.

This is not a bad thing, for the simple reason that every long-lived complex system involving many humans must behave this way.

Any attempt to top-down design the perfect, universal, distributed application runtime hits fundamental social problems not unlike those in a centrally planned economy: too much information to integrate, too many stubbornly uncooperative humans with their own divergent goals and opinions.

Systems at this scale are much more like biology than like circuit design.

Re: Why does Google prepend while(1); to their JSON responses?

#99

Post by gavinpc »

the_mitsuhiko wrote: post #67

Pretty sure browsers no longer permit overriding ctors for literals.

The John Resig post linked by TFA indicates that this was originally dealt with by locking the constructor altogether:

   function Array(){
     alert("hello, I found something of yours!");
   }
   // ERROR: redeclaration of const Array
But it appears that the restriction now applies only to literals, as I can do this in at least Chrome and Firefox:

    function Array() {console.log("hope")}
    undefined
    var x = new Array(3);
    hope
    undefined
https://johnresig.com/blog/re-securing-json/

Re: Why does Google prepend while(1); to their JSON responses?

#100

Post by kijin »

rodorgas wrote: post #91
Tloewald wrote: post #77

Earlier quoted context omitted.

I agree, but of the four major browsers, two are directly underwritten by advertising (Chrome and Mozilla) and Microsoft is moving that way. Only Apple has backed off advertising as a revenue source, so it basically comes down to Apple being willing to cause massive breakage (the way it did with Flash) in pursuit of a principle. The fact that they enabled ad blockers in mobile safari says they are at least sympatheti…

Did you mean Mozilla is an ad driven company?

A very large percentage of Mozilla's revenue comes from search engines (recently Yahoo, previously Google) who pay Mozilla to make themselves the default search engine on Firefox. If Firefox users saw no ads and were untrackable, Yahoo would have no reason to pay anymore.

Of course Mozilla doesn't try to force everyone to stick to the defaults, so you're free to change the default search engine and install a bunch of ad-blocking, anti-tracking add-ons.

Post reply on HN