views:

32

answers:

1

When sniffing Gmail and Facebook traffic, I found there are leading deadlock code before JSON response of XmlHttpRequest.

For example

for (;;);{"t":"continue"}

and

while(1); [["v","nW3OxUDq0kU.en.","8","51bec53f21305d9c"],["di",86]]

What is the purpose of this "for(;;);" and "while(1);" deadlock?

+2  A: 

It's to prevent people from remotely getting to that data from a remote domain by creating a <script> to request it. Of course it has no effect on an XMLHttpRequest because with it you can just skip the infinite loop.

Matti Virkkunen
Can you make a example of harm without this deadlock?
Morgan Cheng
Without the loop, people might be able to get their hands on private data. Of course, if the content is just a JS object, you shouldn't be able to access it with a <script> element at all (no function call involved), so I guess it's there just for extra safety.
Matti Virkkunen
@Morgan: See http://haacked.com/archive/2009/06/25/json-hijacking.aspx and http://haacked.com/archive/2008/11/20/anatomy-of-a-subtle-json-vulnerability.aspx.
Matthew Crumley
@Matthew, thanks.
Morgan Cheng