Community Page
- kid666.com/blog Jump to website »
-
Subscribe -
Community
-
Top Commenters
-
Popular Threads
-
Recent Comments
- So beautiful. I would like to buy it.
- Interesting post. I have stumbled and twittered this for my friends. Hope others find it as interesting as I did.
- I'm looking for a computerized version of Settlers of Catan. I want to find one that can be played offline and independently, and doesn't cost anything to play.
- hi this is a nice post but all about of this topic I do not properly understand. so please descried it.
- Interesting. I had never read this type of article before. Thanks for the post. <a href="http://www.biogetica.com/cure-allergies.php">Cure Allergies</a>
Jump to original thread »
Well, for a while I've been trying to prove that either it is, or isn't, possible to XSS a JSON return which is wrapped in { }.
While it is well known that it is possible to exploit the return of a JavaScript array, I've been trying to establish if it is also possible ... Continue reading »
While it is well known that it is possible to exploit the return of a JavaScript array, I've been trying to establish if it is also possible ... Continue reading »
1 year ago
Look at this Spider Monkey session:
js> {"foo": "bar"}
typein:156: SyntaxError: invalid label:
typein:156: {"foo": "bar"}
typein:156: ......^
js> {quz: "quux"}
quux
js> ({quack: "like a duck"}).quack
like a duck
js> ({quack: "like a duck", jump: "like a kangaroo"}).quack
like a duck
js> ({quack: "like a duck", jump: "like a kangaroo"}).jump
like a kangaroo
js> ({"boo": "like a ghost"}).boo
like a ghost
js> ({"boo": "like a ghost", "flash": "like a firefly"}).flash
like a firefly
js> {"boo": "like a ghost"}
typein:165: SyntaxError: invalid label:
typein:165: {"boo": "like a ghost"}
typein:165: ......^
-So to me it appears that there is some grammatical construct which I'm unfamiliar with interfering with the general grammar of object literals. Also, notice these work:
js> x={"boo": "foo"}
[object Object]
js> var y = {"boo": "foo"}
js> y
[object Object]
I guess the next step is to read the javascript grammar to understand what's happening here.
1 year ago
Arrays on the other hand got a bit of syntactic sugar added to make anonymous arrays valid to allow for multidimensional arrays. This means including an unassigned array object is valid Javascript (but not JSON).
It should be noted though that 3rd party Javascript needs something like AdSafe or Caja to make it safe before you can consider using it on your page. 3rd party scripts can overload Object constructors or other functions to get access to private data.
2 months ago
1 month ago