Recently I read some articles about 'JSON hijacking', and some of one is here.
So, I tried to do below on my browsers, Chrome 17(dev), Firefox 8, and IE8.
- override Object or Array constructor
- modify __defineSetter__ method
- modify defineProperty method
But I couldn't do anything with (literal) JSON data.
Is 'JSON hijacking' problem all solved on modern browser? Or how can I reproduce it?
Object.defineProperty()
or the overriding ofArray
to work in Chrome 16. – Matt Dec 21 '11 at 9:44