What Is Cross Site Script Inclusion (XSSI)?
Cross-site script inclusion stands for XSSI, also known as JSON vulnerability. It uses to allow an attacker's website to read data from a JSON API. The attack works on older browsers by overriding native JavaScript object constructors, and then including an API URL using a tag.
This attack is only successful if the returned Json is executable as JavaScript. Servers can prevent an attack by prefixing all JSON responses to make them non-executable, by convention, using the well-known string ")]}',\n".
Angular's HttpClient library recognizes this convention and automatically strips the string ")]}',\n" from all responses before further parsing.
Most of the update a page's content dynamically via asynchronous JavaScript requests that return JSON data. Sometimes, JSON can contain sensitive data, and if the correct precautions are not in place, it may be possible for an attacker to steal this sensitive information.
For example, I have created a standard HTML page and send you the link; since you trust me, you visit the link I sent you. The page contains only a few lines -
script>function _feed(s) {alert("Your private snippet is: " + s['private_snippet']);}script>script src="http://google-gruyere.appspot.com/611788451095/feed.gtl">script>
The Result looks like –
| Angular 2 vs. Angular 1 | Angular 4 vs. Angular 2 | Angular 5 vs. Angular 4 | Angular 6 vs Angular 5 |
I hope you are enjoying with this post! Please share with you friends. Thank you so much!
