问题:

We're using jQuery and I've come across the following jQuery vulnerability in the National Vulnerability Database:

http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2007-2379

Has this been fixed in more recent versions of jQuery? The original release date on the vulnerability is 4/30/2007.

I'm trying to ensure that the little jQuery we do use doesn't expose this vulnerability, does anyone have examples of it?

回答1:

Have a look at jQuery.getJSON():

If the specified URL is on a remote server, the request is treated as JSONP instead.

Read about JSONP here.

As long as you're using JSONP, this vulnerability doesn't exist.

Also, this 'vulnerability' is stupid. Anyone can exchange data using JSON, it's not just jQuery that uses it.

回答2:

Isn't the problem only there when you use JSONP? It's all safe as long as all the sources are trusted.

As something inherent to JS, there's no way to fix it. Possibly, the XMLHttpRequest/CORS Cross-Origin Resource Sharing spec which is supported by many of the modern browsers (but requires the providing server to be configured to send out the CORS header) could be used instead of JSONP and using Douglas Crockford's JSON2 library (which also falls back on native browser JSON support if available).