python - Tornado - JSON Output sent as Response to be wrapped in dictionary -


i came across section in docs :

requesthandler.write(chunk)

writes given chunk output buffer.

to write output network, use flush() method below.

if given chunk dictionary, write json , set content-type of response application/json. (if want send json different content-type, call set_header after calling write()).

note lists not converted json because of potential cross-site security vulnerability. json output should wrapped in dictionary. more details @ http://haacked.com/archive/2009/06/25/json-hijacking.aspx/ , https://github.com/facebook/tornado/issues/1009

so have few questions related this:

  1. what mean this?

if given chunk dictionary, write json.

  1. what mean this?

note lists not converted json because of potential cross-site security vulnerability.

  1. what mean this? , here, mean json output? , why wrap in dictionary?

all json output should wrapped in dictionary.

  1. this has 2 subparts :

    a. best way send json responses tornado client?

    b. better way send responses? if not json, is? , if json, mention answer subpart (a).

please try answer parts , subparts in numbered manner can understand them properly.

  1. what mean this?

    if given chunk dictionary, write json.

it means, if pass dict write automatically json encoded. method write can handle dict, byte, unicode_type (simplifying str).

  1. what mean this?

    note lists not converted json because of potential cross-site security vulnerability.

assume provide service , request /example/my_service/user_data.json , json response.

if top level object array like:

["john smith", "email@mail"]

then attacker redefine array's constructor , add script tag /example/my_service/user_data.json, gets evaluated - array created attacker's constructor. because standalone array valid javascript code.

since standalone objects, except empty one, not valid js, if return

{"name": "john smith", "email":"email@mail"}

attacker end syntaxerror: missing ; before statement or similar.

more info http://haacked.com/archive/2008/11/20/anatomy-of-a-subtle-json-vulnerability.aspx/

  1. what mean this? , here, mean json output? , why wrap in dictionary?

    all json output should wrapped in dictionary.

as read above, becomes pretty clear, top-level element in json should not array. tornado raise error if pass list.of course can bypass safety, passing string (json dumps before wirte), not wise:

self.write('["this", "is", "wrong"]')

  1. a. best way send json responses tornado client?

    b. better way send responses? if not json, is? , if json, mention answer subpart (a).

i use, if possible, json or xml response. not using tornado's mechanism that, pass encoded object - string write. reason is, it's cleanest way override tornado's encoders , use e.g. ujson.

edit

worth noting modern browsers should not vulnerable.


Comments

Post a Comment

Popular posts from this blog

get url and add instance to a model with prefilled foreign key :django admin -

Image
i have page in each contest shown in row. each row contains contest id , link other model names have foreign key contest. news model: class news(models.model): title = models.charfield(max_length=50, null=true) description = models.textfield() time = models.timefield( default= datetime.datetime.now().time()) contest = models.foreignkey(contest) i want use admin adding , changing these models. want when user clicks on 'news' has foreign key contest id=1, shows list of news value foreign key. use {% instance in instances %} <tr class="{% cycle 'row1' 'row2' %}"> <td>{{ instance.title }}</td> <td>{{ instance.starttime }}</td> <td>{{ instance.timespan }}</td> <td>{{ instance.date }}</td> <td><a href="/adm...
Read more

css - Make div keyboard-scrollable in jQuery Mobile? -

from can tell, although jquery-mobile-powered pages can contain divs overflow set scroll or auto, , these divs can scrolled one-screen bar or mouse wheel, cannot scrolled using arrow keys, page-up/page-down, or home/end. instead, official "page" div (with data-role="page") absorbs input. perhaps other divs can't acquire focus, i'm not sure. is there way around this? edit: jsfiddle of simple example: https://jsfiddle.net/qogz0shx/ <script src="https://ajax.googleapis.com/ajax/libs/jquery/2.1.4/jquery.min.js"></script> <script src="https://ajax.googleapis.com/ajax/libs/jquerymobile/1.4.5/jquery.mobile.min.js"> </script> <link rel="stylesheet" href="https://code.jquery.com/mobile/1.4.5/jquery.mobile-1.4.5.css"/> <style> #outer { overflow:scroll; height: 50vh; width: 50vw; } #inner { height: 500vh; width: 500vw; } ...
Read more

ruby on rails - Seeing duplicate requests handled with Unicorn -

recently upgraded our ec2 instances c3.large in order boost more unicorn workers handle increased traffic our site. (6xworkers per machine - 2 ec2 instances). when did this, started seeing duplicate records being created! looks somehow, maybe 2 unicorn workers attempting process same request? in nginx logs see 1 [post] request particular rails controller - yet 2 records being created in database. i'm hitting kind of race condition issue - have no idea how debug this. doesn't happen time, when it's frustrating well. noticed 2 database records within 5 seconds of each other. (and yes disable button when user clicks submit button). unicorn 4.8.2 ruby 1.9.3 rails 3.2.14 any great! thanks! although may not fix problem, upgrade ruby 2.0.0. there blog mentioning idea upgrade ruby 2.0.0 if using unicorn. for example: https://www.digitalocean.com/community/articles/how-to-optimize-unicorn-workers-in-a-ruby-on-rails-app specifically: if using ruby 1.9, ...
Read more