What is the clarification regarding accessing JSON from various domains?

Question

What is the clarification regarding accessing JSON from various domains?

(I am aware of the fact that ajax calls must originate from the same domain, and have already gone through relevant responses)

However, I am having trouble grasping something:

We often see platforms like Facebook use the for(;;) || while(1) pattern in their json responses:

And naturally, in order to extract and utilize the data, one must remove the for(;;) portion and then parse it accordingly.

I've been advised (by @esailija) that:

You can't strip away the for loop unless the request originates from the same domain, that's the crux of it

Alright, this is all due to the same origin policy.

But I have a question:

Consider John incorporating this on his website (john.com):

 some content...
   <script src="facebook.com/ajax/recent" type="text/javascript"></script>
 some content...

Notice how it's the same URL as Facebook's (indicated by my leftmost red arrow) -

Assumption

If he fetches the response using <scrip>...</script> and the result comes without for(;;), - he'll still be unable to do anything with {"__ar:1,....}! It would need to be padded (like jsonp) with myCallBack({"__ar:1,....});

What I mean is:

var a=1;

{"__ar:1,....}  <--- john won't be able to work with this.

var b=1;

Question :

What am I overlooking and are my assumptions accurate?

javascript ajax cross-domain

Answer 1

Answer №1

Back in the day, there was an issue with using a seemingly innocent array literal - it was not safe. For example, running code like this:

[1,2,3]

Would actually trigger the array constructor with those values, leading to potential harm as demonstrated below:

<script>
Array = function() {
     //Steal the values etc
};
</script>
<script src="facebook.com/yourtimeline.json"></script>
//the above code contains data structures that call the array constructor
//and I can access them.

In the past, if you visited my website on an older browser (think Firefox 2) while logged into Facebook, I could silently retrieve your data in the array constructor if there wasn't a for(;;). However, because it exists, my site will just keep looping endlessly.

Answer 2

Back in the day, there was an issue with using a seemingly innocent array literal - it was not safe. For example, running code like this:

[1,2,3]

Would actually trigger the array constructor with those values, leading to potential harm as demonstrated below:

<script>
Array = function() {
     //Steal the values etc
};
</script>
<script src="facebook.com/yourtimeline.json"></script>
//the above code contains data structures that call the array constructor
//and I can access them.

In the past, if you visited my website on an older browser (think Firefox 2) while logged into Facebook, I could silently retrieve your data in the array constructor if there wasn't a for(;;). However, because it exists, my site will just keep looping endlessly.

Answer 3

Answer №2

Upon receiving the feedback and (like you mentioned) if it did not contain for(;;); at the start, then it would qualify as a valid segment of JavaScript code (an object initializer) with no assigned result. In such cases, it would execute without causing any harm. However, those safeguarding their JSON feeds do not want them to be innocuously executed when exploited inappropriately, hence they introduce this deliberate pollution at the beginning to make the misuse painful by triggering an endless loop.

The common procedure for accessing a feed contaminated with intentional pollution at the commencement involves ensuring that it originates from the same source (or at least one permitted by their CORS policy): You fetch the feed via ajax as plain text, remove the initial for(;;);, and proceed to interpret the remaining content as JSON data.

Answer 4

Upon receiving the feedback and (like you mentioned) if it did not contain for(;;); at the start, then it would qualify as a valid segment of JavaScript code (an object initializer) with no assigned result. In such cases, it would execute without causing any harm. However, those safeguarding their JSON feeds do not want them to be innocuously executed when exploited inappropriately, hence they introduce this deliberate pollution at the beginning to make the misuse painful by triggering an endless loop.

The common procedure for accessing a feed contaminated with intentional pollution at the commencement involves ensuring that it originates from the same source (or at least one permitted by their CORS policy): You fetch the feed via ajax as plain text, remove the initial for(;;);, and proceed to interpret the remaining content as JSON data.

Answer 5

Answer №3

Your initial assumption may have been incorrect, however the second was spot on.

While it's true that you can't make an AJAX request to a different origin, you are able to load a script from a different origin. This is precisely how JSONP handles requests to different origins.

The JSONP format sets itself apart from regular JSON due to this very reason. It involves wrapping JSON data in a function call, allowing the response to be useful. As you guessed correctly, a plain JSON response would not serve any purpose when loaded as a script; it would just undergo evaluation and then be discarded.

Edit

In light of recent edits, the original assumption that the request wouldn't work at all has been omitted from the discussion.

Answer 6

Your initial assumption may have been incorrect, however the second was spot on.

While it's true that you can't make an AJAX request to a different origin, you are able to load a script from a different origin. This is precisely how JSONP handles requests to different origins.

The JSONP format sets itself apart from regular JSON due to this very reason. It involves wrapping JSON data in a function call, allowing the response to be useful. As you guessed correctly, a plain JSON response would not serve any purpose when loaded as a script; it would just undergo evaluation and then be discarded.

Edit

In light of recent edits, the original assumption that the request wouldn't work at all has been omitted from the discussion.

What is the clarification regarding accessing JSON from various domains?

Answer №1

Answer №2

Answer №3

Edit

Similar questions

Using PHP and MySQL to interact with Ajax for posting data

Ways to identify and differentiate user clicks on various buttons

Regular expression for eliminating the local path from a website address

Is it possible to find a more efficient approach than calling setState just once within useEffect?

Preventing ReactJS tooltips from exceeding the boundaries of the screen

Stop Cross-Site Scripting attacks in ajax by filtering the rsargs[]

The list of data in the Jquery/Ajax success response is showing as "undefined."

How can the ordering of dynamically generated components be synchronized with the order of other components?

Encountering a 401 error while attempting to exchange Faceit OAuth authorization code for access token

Exploring the magic of Asp.net Core 2.0 Razor Pages with Ajax Postions

Javascript chart

Guide to updating the content div on a webpage without refreshing using Google App Engine

What is the best way to vertically align an InputLabel within a MUI Grid item?

What is the best method for developing a draggable element that remains stable?

Having trouble passing parameters to Next JS when using the Courtain.js library

Modifying the Ext.js TreePanel checkbox component

How to avoid property sharing in Angular recursive components

Guide to transforming a JSON file value into a JavaScript list

incorporating numerous interconnected javascript files within a single html document

Is it possible to retrieve all data from the Google translation API?