Does anyone know what browsers allow you to override the Array constructor? I was under the impression that modern browsers don't.
<script type="text/javascript">
Object.prototype.__defineSetter__('Id', function(obj){alert(obj);});
</script>
<script src="http://example.com/Home/AdminBalances">/*Boom*/</script>
Example http://jsfiddle.net/V53BL
<script>
Object.prototype.__defineSetter__('user', function(obj){alert('Hijacked!');console.log('Hijacked!', obj)});
var trigger = [{"user":{}}];
</script>
<script id='current-user' src="http://my.secretapi.com/users/current"></script>
[{'user':{'name':'Joe Bloggs'}}]
var x = [{"user":"dude"}]; This won't trigger, and this is what the script include tag executes via the response.
x.user = "wow"; This will trigger, however.
However, the while (1); (or similar tricks) is an easy defense-in-depth measure in case browsers regress in this area or new attacks are found.