Hopiu/angular.js
1
0
Fork 0
mirror of https://github.com/Hopiu/angular.js.git synced 2026-03-17 07:40:22 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

$xhr service now autodetects and strips )]}',\n

Browse source 
")]}\',\n" is a commonly used security prefix added to json http
responses iat google and elsewhere in order to prevent certain
cross-site attacks

$xhr service now autodetects the prefix and strips it before
deserializing the json.

the implementation should be more flexible to allow for wider range
of prefixes, but we need this one right now and can address other
usecases later.
This commit is contained in:
Igor Minar 2011-03-02 17:29:38 -08:00
parent 10a7521f0b
commit cd139f5767
2 changed files with 44 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

7
src/service/xhr.js
View file

@ -79,8 +79,11 @@ angularServiceInject('$xhr', function($browser, $error, $log){
}
$browser.xhr(method, url, post, function(code, response){
try {
if (isString(response) && /^\s*[\[\{]/.exec(response) && /[\}\]]\s*$/.exec(response)) {
response = fromJson(response, true);
if (isString(response)) {
if (response.match(/^\)\]\}',\n/)) response=response.substr(6);
if (/^\s*[\[\{]/.exec(response) && /[\}\]]\s*$/.exec(response)) {
response = fromJson(response, true);
}
}
if (code == 200) {
callback(code, response);

39
test/service/xhrSpec.js
View file

@ -44,4 +44,43 @@ describe('$xhr', function() {
expect($log.error).wasCalledWith("MyException");
});
it('should automatically deserialize json objects', function() {
var response;
$browserXhr.expectGET('/foo').respond('{"foo":"bar","baz":23}');
$xhr('GET', '/foo', function(code, resp) {
response = resp;
});
$browserXhr.flush();
expect(response).toEqual({foo:'bar', baz:23});
});
it('should automatically deserialize json arrays', function() {
var response;
$browserXhr.expectGET('/foo').respond('[1, "abc", {"foo":"bar"}]');
$xhr('GET', '/foo', function(code, resp) {
response = resp;
});
$browserXhr.flush();
expect(response).toEqual([1, 'abc', {foo:'bar'}]);
});
it('should automatically deserialize json with security prefix', function() {
var response;
$browserXhr.expectGET('/foo').respond(')]}\',\n[1, "abc", {"foo":"bar"}]');
$xhr('GET', '/foo', function(code, resp) {
response = resp;
});
$browserXhr.flush();
expect(response).toEqual([1, 'abc', {foo:'bar'}]);
});
});