google / gitiles

A simple browser for Git repositories.
https://gerrit.googlesource.com/gitiles/
Other
582 stars 174 forks source link

JSON export starts with some weird chars #142

Closed mrego closed 6 years ago

mrego commented 6 years ago

JSON export starts with the following chars: )]}'

Example URL: https://chromium.googlesource.com/chromium/src/+log/master?format=JSON Output:

)]}'
{
  "log": [
    {
      "commit": "d49464ef68b1836e18b61ce27d9beeddbb3a69b8",
      "tree": "1d7cfdbfea35302a1727ab4bfecdbd4294f98f28",
      "parents": [
        "d06b421696496929039edf01232ff856b6762433"
      ],
      "author": {
        "name": "Oscar Johansson",
        "email": "oscarj@opera.com",
        "time": "Mon Jul 02 09:35:45 2018"
      },
      "committer": {
        "name": "Commit Bot",
        "email": "commit-bot@chromium.org",
        "time": "Mon Jul 02 09:35:45 2018"
      },
      "message": "Rename kNoPendingResult to be unique (net/)\n\nWhen building using Jumbo unnamed namespaces gets merged\nand variables with the same name conflict. This happens\nfor the variables kNoPendingResult in:\nnet/socket/ssl_client_socket_impl.cc\nnet/socket/ssl_server_socket_impl.cc\n\nThis commit solves the issue by renaming the constants to\nsomething more file specific.\n\nBug: 772146\nChange-Id: I918d551970e249fbb5e0bfadf0ebaeae99ffebcb\nReviewed-on: https://chromium-review.googlesource.com/1119916\nReviewed-by: Josh Karlin \u003cjkarlin@chromium.org\u003e\nCommit-Queue: Oscar Johansson \u003coscarj@opera.com\u003e\nCr-Commit-Position: refs/heads/master@{#571852}"
    },
...
hanwen commented 6 years ago

works as intended. This is a security feature so our JSON results will fail if you try to eval() them.

mrego commented 6 years ago

Thanks for the promt reply, just being curious could you ellaborate about those security concerns? Thanks.

If you query a JSON file you usually want to proccess it. Of course in this case you can just manipulate it and ignore the first line to avoid errors for example.

jrn commented 6 years ago

This is XSSI protection. See https://gerrit-review.googlesource.com/Documentation/rest-api.html#output for a similar case.

mrego commented 6 years ago

Thank you very much for the information. :smile: