This flickr blog post delves into the rationale behind the recent enhancements made to the people selector autocomplete feature.
A significant challenge they had to address was the handling of a vast amount of data (i.e., all user contacts) on the client-side. Initially attempting to fetch XML and JSON through AJAX proved to be slow. They then explored the option of loading data via a dynamically created script tag with a callback function:
JSON and Dynamic Script Tags: Fast but Insecure
Recognizing that extensive string manipulation was impeding progress in their previous method, they transitioned from using Ajax to retrieving data through dynamically generated script tags. By employing this approach, the contact data wasn't treated as a string but executed immediately upon download, similar to a regular JavaScript file. The performance improvement was remarkable: 89ms to parse 10,000 contacts (a reduction of 3 orders of magnitude), with even the smallest case of 172 contacts taking only 6ms. Interestingly, the parsing time per contact decreased as the contact list grew. This method seemed ideal, except for one major flaw: to execute the JSON data, it had to be wrapped in a callback function. Since this was executable code, any website could potentially adopt the same technique to retrieve a Flickr member's contact list. This posed a critical security risk. (emphasis mine)
Could someone provide insights into the specific security threat outlined here (perhaps with a sample exploit)? How does loading a particular file via the "src" attribute in a script tag differ from fetching the same file through an AJAX call?