$xhr service now autodetects and strips )]}',\n

IgorMinar · IgorMinar · commit cd139f57678b · 2011-03-02T22:56:14.000-08:00
")]}\',\n" is a commonly used security prefix added to json http
responses iat google and elsewhere in order to prevent certain
cross-site attacks

$xhr service now autodetects the prefix and strips it before
deserializing the json.

the implementation should be more flexible to allow for wider range
of prefixes, but we need this one right now and can address other
usecases later.
diff --git a/src/service/xhr.js b/src/service/xhr.js
@@ -79,8 +79,11 @@ angularServiceInject('$xhr', function($browser, $error, $log){
     }
     $browser.xhr(method, url, post, function(code, response){
       try {
-        if (isString(response) && /^\s*[\[\{]/.exec(response) && /[\}\]]\s*$/.exec(response)) {
-          response = fromJson(response, true);
+        if (isString(response)) {
+          if (response.match(/^\)\]\}',\n/)) response=response.substr(6);
+          if (/^\s*[\[\{]/.exec(response) && /[\}\]]\s*$/.exec(response)) {
+            response = fromJson(response, true);
+          }
         }
         if (code == 200) {
           callback(code, response);
diff --git a/test/service/xhrSpec.js b/test/service/xhrSpec.js
@@ -44,4 +44,43 @@ describe('$xhr', function() {
 
     expect($log.error).wasCalledWith("MyException");
   });
+
+
+  it('should automatically deserialize json objects', function() {
+    var response;
+
+    $browserXhr.expectGET('/foo').respond('{"foo":"bar","baz":23}');
+    $xhr('GET', '/foo', function(code, resp) {
+      response = resp;
+    });
+    $browserXhr.flush();
+
+    expect(response).toEqual({foo:'bar', baz:23});
+  });
+
+
+  it('should automatically deserialize json arrays', function() {
+    var response;
+
+    $browserXhr.expectGET('/foo').respond('[1, "abc", {"foo":"bar"}]');
+    $xhr('GET', '/foo', function(code, resp) {
+      response = resp;
+    });
+    $browserXhr.flush();
+
+    expect(response).toEqual([1, 'abc', {foo:'bar'}]);
+  });
+
+
+  it('should automatically deserialize json with security prefix', function() {
+    var response;
+
+    $browserXhr.expectGET('/foo').respond(')]}\',\n[1, "abc", {"foo":"bar"}]');
+    $xhr('GET', '/foo', function(code, resp) {
+      response = resp;
+    });
+    $browserXhr.flush();
+
+    expect(response).toEqual([1, 'abc', {foo:'bar'}]);
+  });
 });

Original file line number	Diff line number	Diff line change
`@@ -79,8 +79,11 @@ angularServiceInject('$xhr', function($browser, $error, $log){`
`79`	`79`	`}`
`80`	`80`	`$browser.xhr(method, url, post, function(code, response){`
`81`	`81`	`try {`
`82`		`- if (isString(response) && /^\s[\[\{]/.exec(response) && /[\}\]]\s$/.exec(response)) {`
`83`		`- response = fromJson(response, true);`
	`82`	`+ if (isString(response)) {`
	`83`	`+ if (response.match(/^\)\]\}',\n/)) response=response.substr(6);`
	`84`	`+ if (/^\s[\[\{]/.exec(response) && /[\}\]]\s$/.exec(response)) {`
	`85`	`+ response = fromJson(response, true);`
	`86`	`+ }`
`84`	`87`	`}`
`85`	`88`	`if (code == 200) {`
`86`	`89`	`callback(code, response);`