OWASP suggests wrapping json response with an object rather than returning a direct array. For instance:
[{"id":5}]
Is this vulnerability still relevant? Could it be exploited?
After testing in Chrome, IE, and FF, I couldn't find a way to 'hack' or exploit this.
Example code:
<html>
<head>
<script type="text/javascript">
Object.defineProperty(window,'id',{set: function(obj) {alert(obj);});
</script>
</head>
<body>
<script defer="defer" src="http://example.com/Home/AdminBalances"></script>
</body>
</html>
Regardless of my attempts, I could not trigger the code inside defineProperty without directly setting an id object on the window itself.
If you know of any possible exploits, could you please share sample code?