Comment on Why does Google prepend while(1); to their JSON responses?Comments−westoque9yI wondered the same thing years ago. I always thought that browsers would have implemented other security measures so that websites avoid doing this.Around 90 something percent of websites I visit don't implement that `for(;;)` or `while(1)` solution.So are we saying that they're vulnerable sites?−minitech9yNo, they’re not vulnerable; browsers fixed this bug a long time ago.−coldtea9ySo are we saying that they're vulnerable sites?We are saying that they're vulnerable for THAT particular issue (the JSON hijacking), and that is only if they don't already have some other way of dealing with it.−raulk9ySo are we saying that they're vulnerable sites?Not necessarily, if all their API responses are top-level JSON objects.−Lxr9yThe root object has to be an array I believe.
Comments
I wondered the same thing years ago. I always thought that browsers would have implemented other security measures so that websites avoid doing this.
Around 90 something percent of websites I visit don't implement that `for(;;)` or `while(1)` solution.
So are we saying that they're vulnerable sites?
No, they’re not vulnerable; browsers fixed this bug a long time ago.
We are saying that they're vulnerable for THAT particular issue (the JSON hijacking), and that is only if they don't already have some other way of dealing with it.
Not necessarily, if all their API responses are top-level JSON objects.
The root object has to be an array I believe.