Why do people put code like “throw 1; ” and “for(;;);” in front of json responses? [duplicate]

by

Even without the for(;;); how would the attacker get the data?

Attacks are based on altering the behaviour of the built-in types, in particular Object and Array, by altering their constructor function or its prototype. Then when the targeted JSON uses a {...} or [...] construct, they’ll be the attacker’s own versions of those objects, with potentially-unexpected behaviour.

For example, you can hack a setter-property into Object, that would betray the values written in object literals:

Object.prototype.__defineSetter__('x', function(x) {
    alert('Ha! I steal '+x);
});

Then when a <script> was pointed at some JSON that used that property name:

{"x": "hello"}

the value "hello" would be leaked.

The way that array and object literals cause setters to be called is controversial. Firefox removed the behaviour in version 3.5, in response to publicised attacks on high-profile web sites. However at the time of writing Safari (4) and Chrome (5) are still vulnerable to this.

Another attack that all browsers now disallow was to redefine constructor functions:

Array= function() {
    alert('I steal '+this);
};

[1, 2, 3]

And for now, IE8’s implementation of properties (based on the ECMAScript Fifth Edition standard and Object.defineProperty) currently does not work on Object.prototype or Array.prototype.

But as well as protecting past browsers, it may be that extensions to JavaScript cause more potential leaks of a similar kind in future, and in that case chaff should protect against those too.

More Related Contents:

  1. Why does Google prepend while(1); to their JSON responses?
  2. JSON security best practices?
  3. Why does Google prepend while(1); to their JSON responses?
  4. Serializing to JSON in jQuery [duplicate]
  5. Make cross-domain ajax JSONP request with jQuery
  6. Post data to JsonP
  7. Convert JSON array to an HTML table in jQuery
  8. Can JavaScript connect with MySQL?
  9. No ‘Access-Control-Allow-Origin’ header is present on the requested resource error
  10. Converting a string to JSON object
  11. Why is it a bad practice to return generated HTML instead of JSON? Or is it?
  12. Javascript : Send JSON Object with Ajax?
  13. What are “top level JSON arrays” and why are they a security risk?
  14. How do I load a JSON object from a file with ajax?
  15. Cross-site AJAX requests
  16. loading json data from local file into React JS
  17. How to write data to a JSON file using Javascript
  18. Jquery getJSON populate select menu question
  19. jQuery AJAX polling for JSON response, handling based on AJAX result or JSON content
  20. Get JSON in a Chrome extension
  21. How to prevent direct access to my JSON service?
  22. AJAX call and clean JSON but Syntax Error: missing ; before statement
  23. Make XmlHttpRequest POST using JSON [duplicate]
  24. Alternatives to JavaScript eval() for parsing JSON
  25. SyntaxError: JSON.parse: unexpected character at line 1 column 1 of the JSON data
  26. Cross-Origin resource sharing and file://
  27. Trying to bind multiple InfoWindows to multiple Markers on a Google Map and failing
  28. Adding X-CSRF-Token header globally to all instances of XMLHttpRequest();
  29. How to return an array from an AJAX call?
  30. JQuery getJSON – ajax parseerror

Leave a Comment