Ensuring JSON data protection when sending Ajax requests in JavaScript (for(;;);)

Question

Ensuring JSON data protection when sending Ajax requests in JavaScript (for(;;);)

After extensive research, I have not been able to find the answer I'm looking for despite similar questions being asked.

My query concerns the usage of for(;;); while(1); before an Ajax response outputs a JSON string.

I am curious about how this technique works and would like to implement it similarly to popular sites such as Facebook.

In the ajax.php file, I believe the following needs to be done:

ajax.php

$arr = array("value" => "something", "moreValues" => "moreSomething");
die("for(;;);".json_encode($arr));

The response will look like this:

for(;;);{"value":"something","moreValues":"moreSomething"}

What should one do with this string? Should we remove for(;;); with a substr or something and then use JSON.parse(string)? (If so, why include for(;;); in the response at all?)

Furthermore, how does this approach enhance security and guard against potential infinite loops with the for(;;); statement if something goes wrong?

I feel like there is a missing piece to this puzzle, and I am yet to find a clear example illustrating how to execute this. Any guidance or examples demonstrating the implementation in code would be greatly appreciated! Thanks!

javascript ajax json for-loop response

Answer 1

Answer №1

I managed to resolve this issue using a simple JavaScript solution, which can be implemented as follows:

$.ajax({
    url: mylink',
    type: 'post',
    complete: function(){
        self.removeAttr('disabled');    
        removeLoading();
    },
    success: function(data){
        s1 = new handleData(data);
        if(s1.getError()){
            return setMsgPopup(s1.getError(),1);
        }

        arr = s1.getResult();

    }
});

Below is the handleData class structure:

var handleData = (function(){
    var result=false;
    var error=false;
    var objSize=0;

    var handleData = function(data){
        fixedData = data;
        arr = data.split('for (;;);'); 

        if(!arr[1]){
            this.result = false;
        }else{
            fixedData = arr[1];
        }

        try{
            this.result = JSON.parse(fixedData);
        }catch(e){
            this.result = false;
        }

        if(this.result){
            if(this.result['t'] == undefined){
                if(this.result['error'] != undefined)
                    this.setError(this.result['msg']);
                else
                    this.setError("An error have occured.");
            }
            if(this.result['error'] != undefined)
                this.setError(this.result['msg']);

            if(this.result['t'])
                delete this.result['t'];            
        }else
            this.setError("An error have occured.");

        this.setSize();
    };

    handleData.prototype.setError = function(msgError){
        this.error = msgError;
    };

    handleData.prototype.getError = function(){
        return this.error;
    };

    handleData.prototype.getResult = function(){
        return this.result;
    };

    handleData.prototype.setSize = function(){
        if(!this.result)
            return;

        var size =0;
        for(key in this.result) {
            if(this.result.hasOwnProperty(key))
                size++;
        }
        this.objSize = size;
    };

    handleData.prototype.getSize = function(){
        return this.objSize;
    };

    return handleData;
})();

It's worth noting that this code is quite outdated like the original question itself. There are probably more efficient ways to handle this now, but at the time I applied this fix.

Answer 2

I managed to resolve this issue using a simple JavaScript solution, which can be implemented as follows:

$.ajax({
    url: mylink',
    type: 'post',
    complete: function(){
        self.removeAttr('disabled');    
        removeLoading();
    },
    success: function(data){
        s1 = new handleData(data);
        if(s1.getError()){
            return setMsgPopup(s1.getError(),1);
        }

        arr = s1.getResult();

    }
});

Below is the handleData class structure:

var handleData = (function(){
    var result=false;
    var error=false;
    var objSize=0;

    var handleData = function(data){
        fixedData = data;
        arr = data.split('for (;;);'); 

        if(!arr[1]){
            this.result = false;
        }else{
            fixedData = arr[1];
        }

        try{
            this.result = JSON.parse(fixedData);
        }catch(e){
            this.result = false;
        }

        if(this.result){
            if(this.result['t'] == undefined){
                if(this.result['error'] != undefined)
                    this.setError(this.result['msg']);
                else
                    this.setError("An error have occured.");
            }
            if(this.result['error'] != undefined)
                this.setError(this.result['msg']);

            if(this.result['t'])
                delete this.result['t'];            
        }else
            this.setError("An error have occured.");

        this.setSize();
    };

    handleData.prototype.setError = function(msgError){
        this.error = msgError;
    };

    handleData.prototype.getError = function(){
        return this.error;
    };

    handleData.prototype.getResult = function(){
        return this.result;
    };

    handleData.prototype.setSize = function(){
        if(!this.result)
            return;

        var size =0;
        for(key in this.result) {
            if(this.result.hasOwnProperty(key))
                size++;
        }
        this.objSize = size;
    };

    handleData.prototype.getSize = function(){
        return this.objSize;
    };

    return handleData;
})();

It's worth noting that this code is quite outdated like the original question itself. There are probably more efficient ways to handle this now, but at the time I applied this fix.

Ensuring JSON data protection when sending Ajax requests in JavaScript (for(;;);)

Answer №1

Similar questions

Determine the instance's name as a string in JavaScript

Does the image alter based on the selection in the dropdown menu?

How do I set up Firebase functions to trigger onWrite when listening for a specific child just once?

The method for connecting the width of a panel to the height of the viewport in Ext Js

Organize routes into distinct modules in Angular 6

Tips for retrieving information from a JSON file using PHP and working with multidimensional arrays

Problems during the installation of Webpack

Angular2 - HTML not displaying the response

How to bind array elements in Vue.js

The div swiftly clicks and moves beyond the screen with animated motion

Encountering a Jax-RS error 500 inexplicably when attempting to send back JSON data

What is the correct method for accessing an array within an object that is nested inside an array within a JSON file in Angular?

Leveraging Deferred in conjunction with AJAX

What is the best way to execute a randomly chosen function in JavaScript?

Utilizing Angularjs for dynamic data binding in HTML attributes and style declarations

Modifying the color of a variety of distinct data points

Having issues with Node.js POST requests not functioning properly

Implementing Next.js in a live production environment

When you click on the text, the calendar will pop up for you to

ng-repeat and $scope problem