Permalink
Browse files

Ignore leading garbage in JSON responses.

This accomodates a workaround for a known JSON flaw, which involves
prepending "while(1);" to otherwise-valid JSON responses. See
http://ejohn.org/blog/re-securing-json/ for more info.
  • Loading branch information...
1 parent c23a554 commit 6f400f3f58db8aac6e2f3a8e6a5b77ff0371a637 @bjhomer bjhomer committed Dec 12, 2011
Showing with 22 additions and 4 deletions.
  1. +3 −3 JSON Formatter.safariextension/Info.plist
  2. +19 −1 JSON Formatter.safariextension/formattedJSON.js
@@ -5,15 +5,15 @@
<key>Author</key>
<string>Rick Fletcher</string>
<key>Builder Version</key>
- <string>7534.48.3</string>
+ <string>7534.52.7</string>
<key>CFBundleDisplayName</key>
<string>JSON Formatter</string>
<key>CFBundleIdentifier</key>
<string>ch.flet.safari.jsonformatter</string>
<key>CFBundleInfoDictionaryVersion</key>
<string>6.0</string>
<key>CFBundleShortVersionString</key>
- <string>1.0.2</string>
+ <string>1.0.3</string>
<key>CFBundleVersion</key>
<string>3</string>
<key>Chrome</key>
@@ -48,6 +48,6 @@
<key>Update Manifest URL</key>
<string>http://github.com/rfletcher/safari-json-formatter/raw/latest/Update.plist</string>
<key>Website</key>
- <string>http://github.com/rfletcher/safari-json-formatter</string>
+ <string>http://github.com/bjhomer/safari-json-formatter</string>
</dict>
</plist>
@@ -10,7 +10,11 @@
}
// attempt to parse the body as JSON
try {
- var obj = JSON.parse( document.body.textContent
+ var content = document.body.textContent;;
+ var startAt = formatJSON._firstJSONCharIndex( content );
+ content = content.substring(startAt);
+
+ var obj = JSON.parse( content
.split( "\\" ).join( "\\\\" ) // double-up on escape sequences
.split( '\\\"' ).join( "\\\\\"" ) // at this point quotes have been unescaped. re-escape them.
);
@@ -170,7 +174,21 @@
el.className += " " + t;
return el;
}
+ },
+
+ _firstJSONCharIndex: function ( s ) {
+ var arrayIdx = s.indexOf('[');
+ var objIdx = s.indexOf('{');
+ var idx = 0;
+ if (arrayIdx != -1) {
+ idx = arrayIdx;
+ }
+ if (objIdx != -1) {
+ idx = Math.min(objIdx, idx);
+ }
+ return idx;
}
+
};
// initialize!

0 comments on commit 6f400f3

Please sign in to comment.