I’m wondering what is the reason for using following JSONP response syntax:
Under URL: https://ect.channel.facebook.com/probe?mode=stream&format=json
There is:
for (;;); {"t":"heartbeat"}
{"t":"heartbeat"}
{"t":"continue","seq":0}
My question is, what exactly does for(;;); in this JSONP response. How is it parsed?
This isn’t JSONP; it’s JSON which is delibaretly modified to fail if used as JSONP.
If you include that URL in a
<script>tag, it will freeze the browser in an infinteforloop.This prevents attackers from including it in an external site and calling
Object.definePropertyto create a setter function and bypass the SOP.