Skip to content

Instantly share code, notes, and snippets.

@mala
Created November 25, 2011 06:26
Show Gist options
  • Select an option

  • Save mala/1392927 to your computer and use it in GitHub Desktop.

Select an option

Save mala/1392927 to your computer and use it in GitHub Desktop.
setterとかArrayコンストラクタ書き換えとかの挙動知りたい人向けのサンプル
<html>
<head>
<title>JSON Hijacking Test</title>
</head>
<body>
<script>
Object.prototype.__defineSetter__('test', function(val){ alert(val); return val });
a = [ {"test": "hoge"} ];
b = {"hoge": "hoge"};
b.test = "hoge2";
Object.defineProperty(Object.prototype, 'user', {
set:function(obj) {
for(var i in obj) {
alert(i + '=' + obj[i]);
}
}
});
c = [{ user: {key: "value"} }];
c.user = {a: 12345};
Array = function(){ alert(1) };
d = [1,2,3,4,5];
Array = function(){ alert(2) };
e = new Array();
</script>
</body>
</html>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment