Copied to clipboard

Flag this post as spam?

This post will be reported to the moderators as potential spam to be looked at


  • Wouter van Vugt @ PGGM 5 posts 106 karma points
    Sep 30, 2016 @ 08:40
    Wouter van Vugt @ PGGM
    0

    AngularJsonMediaTypeFormatter generates invalid JSON responses

    Hi,

    during some investigation of the Umbraco codebase I noticed some weird output in calls to the provisioning endpoints such as /install/api/PostPerformInstall. The response started with the characters )]}', simply a bunch of unwanted closing tags since there are no opening tags. Investigation of the codebase led to the AngularJsonMediaTypeFormatter class, which does this:

    using (StreamWriter writer = new StreamWriter(writeStream, encoding))
    {
        writer.Write(")]}',\n");
        writer.Flush();
        return base.WriteToStreamAsync(type, value, writeStream, content, transportContext);
    }
    

    Given that is a bad practice of writing closing tags without doing the opening tags in the same method, I thought I'd report this issue here.

    Regards,

    Wouter

  • Michaël Vanbrabandt 863 posts 3347 karma points c-trib
    Sep 30, 2016 @ 09:50
    Michaël Vanbrabandt
    0

    Hi Wouter,

    this attribute is used to prevent vulnerabilitie attacks when using json with angularjs.

    What it does is indeed prepent the response with some characters, but Angularjs will strip these.

    Read more about it here: AngularJS $http under Security Considerations.

    Hope this helps.

    /Michaël

  • Wouter van Vugt @ PGGM 5 posts 106 karma points
    Sep 30, 2016 @ 09:58
    Wouter van Vugt @ PGGM
    1

    Nice! Thanks. Something new to learn every day!

    Wouter

  • Michaël Vanbrabandt 863 posts 3347 karma points c-trib
    Sep 30, 2016 @ 10:37
    Michaël Vanbrabandt
    0

    No problem!

    Have a nice day

    /Michaël

  • Alexander Tkacuk 16 posts 97 karma points
    Feb 22, 2022 @ 07:33
    Alexander Tkacuk
    0

    Hi,

    how can i disable it? In some reasons i dont want to have it as response. Is there another Formater for V9, so i dont need create my own?

Please Sign in or register to post replies

Write your reply to:

Draft