Luke said:
David Wahler napisal(a):
Can you point how to get around the same origin restriction ? (Can i
use XmlHttpRequest open() URL parameter which is in different origin
(domain) than my script/document when i do it via eval( ) ? )
Sorry, I didn't phrase that very well. eval() doesn't break
cross-domain security by itself; however, it increases the likelihood
of cross-site scripting (XSS) attacks. Let me use a quick example:
suppose you have a fancy, AJAXified database which stores records in
JSON format, like so:
// (this is just an example)
var rowString = '{
"id": "12345",
"foo": "bar"
}';
var row= eval('('+rowString+')');
document.write(row.id);
If you use eval() to parse the rows, then anyone who can submit data
can inject code that runs in the context of your site. Since they're
running their code on your site, they're getting around the same origin
restriction, and they can then do all kinds of evil things:
var rowString = '(function() {
var req = new XMLHTTPRequest();
req.open("POST", "/messageboard/changepassword.cgi", false);
req.send("newpassword=haxxored");
return {"id": "I just changed your password!"};
})()';
var row= eval('('+rowString+')');
document.write(row.id);
This means that anyone who views that database row gets their password
changed, and their account compromised. If you don't think this type of
attack is plausible, MySpace--which had taken extensive security
precautions--had their security blown out of the water by a JavaScript
worm just over a month ago:
http://blog.outer-court.com/archive/2005-10-13-n73.html
If you don't want this to happen, you have (off the top of my head)
three options:
1) Use a real JSON parser on the client.
2) Use a real JSON parser on the server, that carefully verifies all
data that gets submitted.
3) Don't use JSON for client-to-server communications, but some other
protocol; this largely defeats the purpose of using JSON in the first
place, which is simplicity.
And here you don't understand the concept. JSON site states that when i
have stringified JSON data structure a can use eval to get it back as a
reference in JavaScript so to use it as object/array/string etc....
I do understand the concept, but maybe I wasn't making myself clear (if
that is the case, I apologize). You can parse JSON with eval(), but
"can" is not the same as "should". The JSON site also states: "When
security is a concern it is better to use a JSON parser. A JSON parser
will only recognize JSON text and so is much safer."
(i can also use JSON.parse - but it is slower then eval - and i don't have
to use parse if i know that received data from XmlHttpRequest object is
JSON stringified data structure).
By all means, go ahead and use eval(), but bear in mind that you're
trusting your security to the integrity of that received data. If
you're confident that your data is trustworthy, that's your decision to
make.
-- David
