Hacker News Reader

Comment by primaryobjects | Hacker News Reader

That's interesting. Apparently, the __defineSetter__ call is still valid in Chrome.

I can't get this to work with an actual API call.

    <script>
          Object.prototype.__defineSetter__('user', function(obj){alert('Hijacked!');console.log('Hijacked!', obj)});
          var trigger = [{"user":{}}];
     </script>
     <script id='current-user' src="http://my.secretapi.com/users/current"></script>

Where the API returns something like

    [{'user':{'name':'Joe Bloggs'}}]

(Un)Fortunately (depending on which side of this you're on...) they've plugged the holes?

It works on an explicit set, but not on initialization of the object. So:

var x = [{"user":"dude"}]; This won't trigger, and this is what the script include tag executes via the response.

x.user = "wow"; This will trigger, however.

And that's by design. That's how setters work. There's no security risk from this, given cross-domain JSON loads.

Reply on news.ycombinator.com