After loading the web page, I utilize AJAX to populate a list asynchronously. However, when the AJAX request is sent to retrieve data for the list box, instead of receiving JSON data as expected, an unintended web page containing the list box is returned.
[Components]
haveList.jsp: This file contains the list box and includes the <script src="loadData.js"> tag.
loadData.js: It generates an AJAX request to the server right after haveList.jsp is loaded. (I used an alert to confirm that the request retrieves the correct data from the server.)
returnPage.java: A servlet that forwards to haveList.jsp
returnJsonData.java: A servlet that returns the JSON string requested by loadData.js
These components are detailed below.
[web.xml]
<servlet>
<servlet-name>ReturnPage</servlet-name>
<servlet-class>pkg.ReturnPage</servlet-class>
</servlet>
<servlet-mapping>
<servlet-name>ReturnPage</servlet-name>
<url-pattern>/openHaveList.do</url-pattern>
</servlet-mapping>
<servlet>
<servlet-name>DataManager</servlet-name>
<servlet-class>pkg.ReturnJsonData</servlet-class>
</servlet>
<servlet-mapping>
<servlet-name>DataManager</servlet-name>
<url-pattern>/requestListData.do</url-pattern>
</servlet-mapping>
[Phenomenon]
When I sent "openHaveList.do" to the server, it returned the page "haveList". Immediately afterward, an AJAX request was made to fetch JSON data (requestListData.do) as specified in loadData.js. Upon inspecting the responseText using alert(), I noticed that instead of JSON data, the HTML content of haveList.jsp was returned.
[Clues]
(1) When unintentional HTML content was received from the server, the browser's address bar displayed http://localhost/openHaveList.do. (This occurred when clicking on an image on another page.)
(2) By examining the request/response with ZAP (Zed Attack Proxy), I observed that 2 requests were made:
- The first: requestListData.do (Response: empty)
- The second: openHaveList.do (Response: HTML content of haveList.jsp)
Due to this observation, I suspect that the AJAX request is being redirected unintentionally (from requestListData.do to openHaveList.do).
- Source Codes -
[haveList.jsp]
Contains nothing special. Just a list box.
[loadData.js]
(function () {
var conn=null, addEvent=null, createXHR=null, loadNations = null, setAsyncLoad=null;
// More JavaScript code here...
}());
[returnPage.java]
// Java code for ReturnPage servlet.
[returnJsonData.java]
// Java code for ReturnJsonData servlet.