can.Model.findAll promotes usage of XSS attack vector

[jeffrose]

Model.find() assumes that the related service will return an object.

{ "name": "do the dishes" }

Model.findAll() assumes that the related service will return an array of objects, where each object is a model.

[ { "name": "do the dishes" }, { "name": "pick up milk" } ]

Returning an array as the root entity of a JSON service opens that service up to a XSS attack.

http://haacked.com/archive/2008/11/20/anatomy-of-a-subtle-json-vulnerability.aspx

The fix is to wrap the array in an object.

{ "data": [ { "name": "do the dishes" }, { "name": "pick up milk" } ] }

[daffl]

The can.Model.models converter already does this: https://github.com/bitovi/canjs/blob/master/model/model.js#L734

If you would like it mentioned in the documentation you can submit a pull request with the updated documentation.

[justinbmeyer]

Reopened b/c we should update our docs to show this as the standard way of sending data. We shouldn't show a vulnerability.

[justinbmeyer]

http://canjs.us/#can_model-findall