Wednesday, 10 May 2017

javascript - Why do people put code like "throw 1; " and "for(;;);" in front of json responses?











Google returns json like this:



throw 1;  { foo: bar}


and Facebooks ajax has json like this:



for(;;); {"error":0,"errorSummary": ""}




  • Why do they put code that would stop
    execution and makes invalid json?

  • How do they parse it if it's invalid
    and would crash if you tried to eval
    it?

  • Do they just remove it from the
    string (seems expensive)?


  • Are there any security advantages to
    this?



In response to it being for security purposes:



If the scraper is on another domain they would have to use a script tag to get the data because XHR won't work cross-domain. Even without the for(;;); how would the attacker get the data? It's not assigned to a variable so wouldn't it just be garbage collected because there's no references to it?



Basically to get the data cross domain they would have to do







But even without the crash script prepended the attacker can't use any of the Json data without it being assigned to a variable that you can access globally (it isn't in these cases). The crash code effectivly does nothing because even without it they have to use server sided scripting to use the data on their site.


Answer




Even without the for(;;); how would the attacker get the data?




Attacks are based on altering the behaviour of the built-in types, in particular Object and Array, by altering their constructor function or its prototype. Then when the targeted JSON uses a {...} or [...] construct, they'll be the attacker's own versions of those objects, with potentially-unexpected behaviour.




For example, you can hack a setter-property into Object, that would betray the values written in object literals:



Object.prototype.__defineSetter__('x', function(x) {
    alert('Ha! I steal '+x);
});


Then when a

Subscribe to: Post Comments (Atom)

c++ - Does curly brackets matter for empty constructor?

Those brackets declare an empty, inline constructor. In that case, with them, the constructor does exist, it merely does nothing more than t...