5 ms·

That's interesting. Apparently, the __defineSetter__ call is still valid in Chrome. Example http://jsfiddle.net/V53BL http://jsfiddle.net/V53BL

• madeofpalk 13y ago
  I can't get this to work with an actual API call. <script> Object.prototype.__defineSetter__('user', function(obj){alert('Hijacked!');console.log('Hijacked!', obj)}); var trigger = [{"user":{}}]; </script> <script id='current-user' src="http://my.secretapi.com/users/current"></script> Where the API returns something like [{'user':{'name':'Joe Bloggs'}}] (Un)Fortunately (depending on which side of this you're on...) they've plugged the holes?
  • primaryobjects 13y ago
    It works on an explicit set, but not on initialization of the object. So: var x = [{"user":"dude"}]; This won't trigger, and this is what the script include tag executes via the response. x.user = "wow"; This will trigger, however.
    • gsnedders 13y ago
      And that's by design. That's how setters work. There's no security risk from this, given cross-domain JSON loads.