jquery $.ajax function using a variable URL

Question

var array = new Array();
$.get('comics.txt', function(data) {
    array = data.split(",");
    for(var i = 0; i < array.length; i++)
    {
        var $page = array[i];
        $.ajax({
            url: $page,
            success: function(data) {
                alert(data);
            }
        });
    }
});

comics.txt is a file which contains some urls, separated by commas.

In the above code, the $.ajax call does not work; $page is the correct url, but it's not working in the context. alert(data) causes a blank alert box to come up. I need help figuring out a way to get the data from each page in the array called array.

Thanks ahead of time.

Answer 1

is $page a url on your domain?... if not, you cannot do ajax...

same domain policy

---

If so, how can I get data via javascript from foreign URLs?

you have yo get it from your server...

for example..

var array = new Array();
$.get('comics.txt', function(data) {
    array = data.split(",");
    for(var i = 0; i < array.length; i++)
    {
        var $page = array[i];
        $.ajax({
            url: 'your/server/url.php?page=' + $page,
            success: function(data) {
                alert(data);
            }
        });
    }
});

your/server/url.php can get the page for you...

Answer 2

You can't make requests to other domains from your client's browser. It's a huge security risk. This code will work if the URLs in the text file are on the same domain as the javascript is running.

Answer 3

You can cross-site script by dynamically adding a script element to the DOM with the src attribute pointing to wherever you like; as long as whatever's referenced in src returns JavaScript (protip: execute a pre-defined function at the end of the XSS for AJAX-like behaviour), it should work.

Site 1:

<script type="text/javascript">
$(document).ready( function() {
   $('body').append($("<script>").attr('src', "http://mydomain.com/xss.js"));
} );

function alerty (thing) {
    alert(thing);
}
</script>

Site 2 (xss.js):

var mystring = "hello";

if (typeof(alerty) != "undefined") {
   alerty(mystring);
}

Obviously the URL doesn't have to be a flat file - it could be JavaScript which is constructed by PHP based on GET requests in the URL. Also this presumes you have control of the remote data, which you may not.