Why does Facebook’s XHR request have that code?

Question

I was analyzing the XHR requests from Facebook for study purposes and came across a code that I found curious to say the least.

On the link similar to this 4-edge-chat.facebook.com/pull, has the following code:

for (;;); {"t":"fullReload","seq":3}

Well done! As far as I know, this one for(;;) causes an infinite loop (which can even lock the browser if it runs on console).

What is the reason some of the Facebook scripts have this code? It would be to avoid external inclusion or something like?

Answer 1

TL;DR

Yes, it is to avoid a very specific type of attack based on Json requests on different domains.

A type of attack

According to an article from You’ve Been Haacked, one of the attacks in this category can be classified as a combination of cross-site request forgery or XSRF and some loopholes in older browsers that allowed malicious scripts to read all or part of the content returned from JSON requests to other domains.

XSRF briefly is when a malicious script requests to a remote server (Facebook in this case) using the user’s credentials to act on the user’s behalf or obtain sensitive data.

How the attack works

The idea is basically the following:

1. The user authenticates to Facebook
2. User accesses a malicious website
3. A script on the malicious site uses a tag <script> to make a request GET to the Facebook web service that returns a JSON
4. Malicious script can bypass browser security and get back data from Facebook request

Example of implementation of the attack

Taken from the site cited above, consider the following example:

<script type="text/javascript">
var secrets;

Array = function() {
  secrets = this;
};


<script src="http://haacked.com/demos/secret-info.json" 
  type="text/javascript">

<script type="text/javascript">

  var yourData = '';
  var i = -1;
  while(secrets[++i]) {
    yourData += secrets[i] + ' ';
  }

  alert('I stole your data: ' + yourData);
</script>

In some older browsers, the above code makes the variable secrets receive the values of any new Array created after the execution of the initial section. It is a redeclaration of the constructor.

Then the tag <script> makes the request to the other server and, if there is a Array in the returned JSON, the data will be captured.

Completion

Even though modern browsers make it very difficult to capture data on such request types, the infinite loop for makes the malicious script have no chance of doing anything with possible data that could be obtained in web services calls using tags <script>.

So it’s one more element in security.