javascript - 为什么服务器不应该使用 JSON 数组进行响应？

Question

根据this Angular 2 guide :

Don't expect the decoded JSON to be the heroes array directly. This server always wraps JSON results in an object with a data property. You have to unwrap it to get the heroes. This is conventional web API behavior, driven by security concerns.

(“英雄”是一个对象数组)。
link上一段说:

Always return JSON with an Object on the outside
Always have the outside primitive be an object for JSON strings:
Exploitable: [{"object": "inside an array"}]
Not exploitable: {"object": "not inside an array"}
Also not exploitable: {"result": [{"object": "inside an array"}]}

我的问题是:为什么服务器不应该返回 JSON 数组之类的东西？说 :
[
“苹果”
,“橙子”
， “桃子”
]

这怎么会是一个安全问题呢？

Answer 1

避免JSON Hijacking :

The fact that this is a JSON array is important. It turns out that a script that contains a JSON array is a valid JavaScript script and can thus be executed. A script that just contains a JSON object is not a valid JavaScript file.

For example, if you had a JavaScript file that contained the following JSON: {“Id”:1, “Balance”:3.14} And you had a script tag that referenced that file: <script src="http://example.com/SomeJson"></script>

You would get a JavaScript error in your HTML page. However, through an unfortunate coincidence, if you have a script tag that references a file only containing a JSON array, that would be considered valid JavaScript and the array gets executed.

因此，允许 JSON 作为除对象之外的任何内容返回，将可以返回一个 JSON 数组，其中包含可以在客户端级别运行的代码(在客户端不希望它可运行的上下文中，可能是恶意的，等等)。只有返回 JSON 对象才能防止这种情况发生。