diff --git a/src/json.js b/src/json.js index 6f40f57..6cfdde6 100644 --- a/src/json.js +++ b/src/json.js @@ -12,6 +12,7 @@ define(['text'], function(text){ jsonParse = (typeof JSON !== 'undefined' && typeof JSON.parse === 'function')? JSON.parse : function(val){ return eval('('+ val +')'); //quick and dirty }, + PROTECTION_PREFIX = /^\)\]\}',?\n/, buildMap = {}; function cacheBust(url){ @@ -35,7 +36,9 @@ define(['text'], function(text){ buildMap[name] = data; onLoad(data); } else { + // Need to check if the JSON data has been formatted for the JSON array security vulnerability try { + data = data.replace(PROTECTION_PREFIX, ''); parsed = jsonParse(data); } catch (e) { onLoad.error(e);