json.net - json asmx 和那个讨厌的 d :

Question

我浏览了很多帖子，但没有成功地确定如何摆脱来 self 的 asmx Web 服务的响应中讨厌的 d，如 {"d":{"Response":"OK","Auth-Key":"JKPYZFZU"}}。

这是由我的类“public Dictionary UserDevice”通过返回 Dictionary 对象创建的。

如果这该死的东西不把它全部放入 d 对象中，我会非常高兴!

Answer 1

基本上，JSON 数组表示法 ['hello'] 本身就是有效的 JavaScript，而 JSON 对象表示法 {'d': ['hello'] } 本身不是有效的 JavaScript有效的 JavaScript。这导致数组符号可执行，从而开启了 XSS 攻击的可能性。默认情况下将数据包装在对象中有助于防止这种情况。

您可以在 post by Dave Ward 中阅读更多有关它为何存在的信息。 。 (编辑:正如 @user1334007 所指出的，Chrome 现在将此网站标记为不安全)

戴夫·里德 (Dave Reed) 对该文章的评论特别具有启发性:

It’s one of those security features that has a very easy tomisunderstand purpose. The protection isn’t really againstaccidentally executing the alert in your example. Although that is onebenefit of ‘d’, you’d still have to worry about that while evaluatingthe JSON to convert it to an object.

What it does do is prevent the JSON response from being wholesaleexecuted as the result of a XSS attack. In such an attack, theattacker could insert a script element that calls a JSON webservice,even one on a different domain, since script tags support that. And,since it is a script tag afterall, if the response looks likejavascript it will execute as javascript. The same XSS attack canoverload the object or array constructors (among other possibilities)and thereby get access to that JSON data from the other domain.

To successfully pull that off, you need (1) a xss vulnerable site(good.com) — any site will do, (2) a JSON webservice that returns adesired payload on a GET request (e.g. bank.com/getaccounts), (3) anevil location (evil.com) to which to send the data you captured frombank.com while people visit good.com, (4) an unlucky visitor togood.com that just happened to be logged into bank.com using the samebrowser session.

Protecting your JSON service from returning valid javascript is justone thing you can do to prevent this. Disallowing GET is another(script tags always do GET). Requiring a certain HTTP header isanother (script tags can’t set custom headers or values). Thewebservice stack in ASP.NET AJAX does all of these. Anyone creatingtheir own stack should be careful to do the same.