Why does Google prepend while(1); to their JSON responses?

Re:Why does Google prepend while(1); to their JSON responses? by joev_ on Sunday December 29, 2013 @10:20PM (#6982847)

Actually, ie is still vulnerable to a very similar attack in some cases, specifically you can leak responses containing small json array by inlining the json as a script[src=vbscript] tag. Disclosed here: http://en.wooyun.org/bugs/wooyun-2013-023

with the status "unable to contact the vendor or actively neglected by the vendor" :-/

Edit: I meant "injecting" not inlining. Thanks chc for pointing that out.

[ Parent | on HN ]

Re:Why does Google prepend while(1); to their JSON responses? by chc on Sunday December 29, 2013 @11:09PM (#6982988)

If it has to be inlined, how is that the same vulnerability? I thought the vulnerability was that script tags can fetch external scripts and a local script intercept the results. If you have to inline both scripts, you can only attack yourself.

[ Parent | on HN ]

Re:Why does Google prepend while(1); to their JSON responses? by joev_ on Sunday December 29, 2013 @11:16PM (#6983010)

Sorry, used the wrong term. I mean it can be injected as a script tag into an xdomain site.

[ Parent | on HN ]

Re:Why does Google prepend while(1); to their JSON responses? by Stealth- on Sunday December 29, 2013 @11:42PM (#6983075)

VERY interesting, thanks for sharing! I'll have to play around with this a bit...

[ Parent | on HN ]

Re:Why does Google prepend while(1); to their JSON responses? by joev_ on Sunday December 29, 2013 @11:56PM (#6983105)

Yeah it's a neat attack. pretty glaring info leak imho. Even an empty array response can expose login status

[ Parent | on HN ]