blocks|key|187854|text|不再可能捕获传递给Firefox21、Chrome27或IE10中的[]或{}构造函数的值。|type|unstyled|depth|inlineStyleRanges|offset|length|style|CODE|entityRanges|data|187855|(http://jsfiddle.net/ph3Uv/2/)|187856|​|187857|var+capture+=+function()+{
++++var+ta+=+document.querySelector('textarea')
	ta.innerHTML+=+'';
	ta.appendChild(document.createTextNode("Captured:+"%2BJSON.stringify(arguments)));
	return+arguments;
}
var+original+=+Array;

var+toggle+=+document.body.querySelector('input[type="checkbox"]');
var+toggleCapture+=+function()+{
++++var+isOn+=+toggle.checked;
++++window.Array+=+isOn+?+capture+:+original;
++++if+(isOn)+{
++++++++Object.defineProperty(Object.prototype,+'foo',+{set:+capture});++++
++++}+else+{
++++++++delete+Object.prototype.foo;
++++}
};
toggle.addEventListener('click',+toggleCapture);
toggleCapture();

[].forEach.call(document.body.querySelectorAll('input[type="button"]'),+function(el)+{
++++el.addEventListener('click',+function()+{
++++++++document.querySelector('textarea').innerHTML+=+'Safe.';
++++++++eval(this.value);
++++});
});|code-block|syntax|javascript|187858|<div><label><input+type="checkbox"+checked="checked">+Capture</label></div>
<div><input+type="button"+value="[1,+2]"+/>+<input+type="button"+value="Array(1,+2);"+/>+<input+type="button"+value="{foo:+'bar'}"+/>+<input+type="button"+value="({}).foo+=+'bar';"+/></div>
<div><textarea></textarea></div>|187859|187860|它覆盖了window.Array，并向Object.prototype.foo添加了一个设置器，并通过短格式和长格式测试初始化数组和对象。|187861|在第1.5节中，ES4+spec“要求使用对象和数组的全局标准绑定来构造对象和数组初始值设定项的新对象”，并在实现先例中指出"Internet+Explorer6、Opera9.20和Safari3不考虑对象和数组的局部或全局重新绑定，而是使用原始的对象和数组构造函数。“这将保留在ES5,+section+11.1.4中。|187862|Allen+Wirfs-Brock+explained指出，ES5还指定对象初始化不应触发setter，因为它使用DefineOwnProperty。MDN:+Working+with+Objects指出，“从JavaScript+1.8.1开始，在对象和数组初始化器中设置属性时不再调用setter。”这是在V8+issue+1015中解决的。|187863|entityMap|0|LINK|mutability|MUTABLE|url|http://jsfiddle.net/ph3Uv/2/|1|http://www.ecmascript.org/es4/spec/incompatibilities.pdf|2|http://ecma-international.org/ecma-262/5.1/#sec-11.1.4|3|https://mail.mozilla.org/pipermail/es-discuss/2010-December/012494.html|4|https://developer.mozilla.org/en-US/docs/Web/JavaScript/Guide/Working_with_Objects?redirectlocale=en-US&redirectslug=JavaScript/Guide/Working_with_Objects#Defining_getters_and_setters|5|http://code.google.com/p/v8/issues/detail?id=1015^0|Y|2|11|2|0|1|S|0|0|0|0|0|0|4|C|J|K|0|8|8|1|3X|J|2|0|0|R|3|23|P|4|4B|D|5|0^^$0|@$1|2|3|4|5|6|7|1F|8|@$9|1G|A|1H|B|C]|$9|1I|A|1J|B|C]]|D|@]|E|$]]|$1|F|3|G|5|6|7|1K|8|@]|D|@$9|1L|A|1M|1|1N]]|E|$]]|$1|H|3|I|5|6|7|1O|8|@]|D|@]|E|$]]|$1|J|3|K|5|L|7|1P|8|@]|D|@]|E|$M|N]]|$1|O|3|P|5|L|7|1Q|8|@]|D|@]|E|$M|N]]|$1|Q|3|I|5|6|7|1R|8|@]|D|@]|E|$]]|$1|R|3|S|5|6|7|1S|8|@$9|1T|A|1U|B|C]|$9|1V|A|1W|B|C]]|D|@]|E|$]]|$1|T|3|U|5|6|7|1X|8|@]|D|@$9|1Y|A|1Z|1|20]|$9|21|A|22|1|23]]|E|$]]|$1|V|3|W|5|6|7|24|8|@]|D|@$9|25|A|26|1|27]|$9|28|A|29|1|2A]|$9|2B|A|2C|1|2D]]|E|$]]|$1|X|3|-4|5|6|7|2E|8|@]|D|@]|E|$]]]|Y|$Z|$5|10|11|12|E|$13|14]]|15|$5|10|11|12|E|$13|16]]|17|$5|10|11|12|E|$13|18]]|19|$5|10|11|12|E|$13|1A]]|1B|$5|10|11|12|E|$13|1C]]|1D|$5|10|11|12|E|$13|1E]]]]

<p>No, it is no longer possible to capture values passed to the <code>[]</code> or <code>{}</code> constructors in Firefox 21, Chrome 27, or IE 10. Here's a little test page, based on the main attacks described in <a href="http://www.thespanner.co.uk/2011/05/30/json-hijacking/" rel="noreferrer">http://www.thespanner.co.uk/2011/05/30/json-hijacking/</a>:</p>

<p>(<a href="http://jsfiddle.net/ph3Uv/2/" rel="noreferrer">http://jsfiddle.net/ph3Uv/2/</a>)</p>

<p><div class="snippet" data-lang="js" data-hide="false" data-console="true" data-babel="false">
<div class="snippet-code">
<pre class="snippet-code-js lang-js prettyprint-override"><code>var capture = function() {
    var ta = document.querySelector('textarea')
	ta.innerHTML = '';
	ta.appendChild(document.createTextNode("Captured: "+JSON.stringify(arguments)));
	return arguments;
}
var original = Array;

var toggle = document.body.querySelector('input[type="checkbox"]');
var toggleCapture = function() {
    var isOn = toggle.checked;
    window.Array = isOn ? capture : original;
    if (isOn) {
        Object.defineProperty(Object.prototype, 'foo', {set: capture});    
    } else {
        delete Object.prototype.foo;
    }
};
toggle.addEventListener('click', toggleCapture);
toggleCapture();

[].forEach.call(document.body.querySelectorAll('input[type="button"]'), function(el) {
    el.addEventListener('click', function() {
        document.querySelector('textarea').innerHTML = 'Safe.';
        eval(this.value);
    });
});</code></pre>
<pre class="snippet-code-html lang-html prettyprint-override"><code>&lt;div&gt;&lt;label&gt;&lt;input type="checkbox" checked="checked"&gt; Capture&lt;/label&gt;&lt;/div&gt;
&lt;div&gt;&lt;input type="button" value="[1, 2]" /&gt; &lt;input type="button" value="Array(1, 2);" /&gt; &lt;input type="button" value="{foo: 'bar'}" /&gt; &lt;input type="button" value="({}).foo = 'bar';" /&gt;&lt;/div&gt;
&lt;div&gt;&lt;textarea&gt;&lt;/textarea&gt;&lt;/div&gt;</code></pre>
</div>
</div>
</p>

<p>It overrides <code>window.Array</code> and adds a setter to <code>Object.prototype.foo</code> and tests initializing arrays and objects via the short and long forms.</p>

<p>The <a href="http://www.ecmascript.org/es4/spec/incompatibilities.pdf" rel="noreferrer">ES4 spec</a>, in section 1.5, "requires the global, standard bindings of Object and Array to be used to construct new objects for object and array initializers" and notes in Implementation Precedent that "Internet Explorer 6, Opera 9.20, and Safari 3 do not respect either local or global rebindings of Object and Array, but use the original Object and Array constructors." This is retained in <a href="http://ecma-international.org/ecma-262/5.1/#sec-11.1.4" rel="noreferrer">ES5, section 11.1.4</a>.</p>

<p><a href="https://mail.mozilla.org/pipermail/es-discuss/2010-December/012494.html" rel="noreferrer">Allen Wirfs-Brock explained</a> that ES5 also specifies that object initialization should not trigger setters, as it uses DefineOwnProperty. <a href="https://developer.mozilla.org/en-US/docs/Web/JavaScript/Guide/Working_with_Objects?redirectlocale=en-US&amp;redirectslug=JavaScript/Guide/Working_with_Objects#Defining_getters_and_setters" rel="noreferrer">MDN: Working with Objects</a> notes that "Starting in JavaScript 1.8.1, setters are no longer called when setting properties in object and array initializers." This was addressed in <a href="http://code.google.com/p/v8/issues/detail?id=1015" rel="noreferrer">V8 issue 1015</a>.</p>


<p>I am using Backbone.js and the Tornado web server.  The standard behavior for receiving collection data in Backbone is to send as a JSON Array.</p>

<p>On the other hand, Tornado's standard behavior is to not allow JSON Array's due to the following vulnerability:</p>

<p><a href="http://haacked.com/archive/2008/11/20/anatomy-of-a-subtle-json-vulnerability.aspx" rel="noreferrer">http://haacked.com/archive/2008/11/20/anatomy-of-a-subtle-json-vulnerability.aspx</a></p>

<p>A related one is:
<a href="http://haacked.com/archive/2009/06/25/json-hijacking.aspx" rel="noreferrer">http://haacked.com/archive/2009/06/25/json-hijacking.aspx</a></p>

<p>It feels more natural for me to not have to wrap up my JSON in an object when it really is a list of objects.</p>

<p>I was unable to reproduce these attacks in modern browsers (i.e. current Chrome, Firefox, Safari, and IE9).  At the same time I was unable to confirm anywhere that modern browsers had addressed these issues.</p>

<p>To ensure that I am mislead neither by any possible poor programming-skills nor poor googling-skills:</p>

<p><strong>Are these JSON Hijacking attacks still an issue today in modern browsers?</strong></p>

<p>(Note:  Sorry for the possible duplicate to: <a href="https://stackoverflow.com/questions/8587567/is-it-possible-to-do-json-hijacking-on-modern-browser">Is it possible to do &#39;JSON hijacking&#39; on modern browser?</a>  but since the accepted answer does not seem to answer the question - I thought it was time to ask it again and get some clearer explanations.)</p>


Is JSON Hijacking still an issue in modern browsers?

服务器

JSON

我使用的是Backbone.js和Tornado web服务器。在Backbone中接收收集数据的标准行为是作为JSON数组发送。另一方面，Tornado的标准行为是由于以下漏洞而不允许JSON数组：与之相关的是：对我来说，当JSON实际上是一个对象列表时，不必将JSON包装在对象中，这感觉更自然。我无法在现代浏览器(...

问JSON劫持在现代浏览器中仍然是一个问题吗？
EN

社区

活动

资源

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问JSON劫持在现代浏览器中仍然是一个问题吗？EN

社区

活动

资源

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问JSON劫持在现代浏览器中仍然是一个问题吗？
EN