Facebook api chart. JSONP format, what does / * * / mean in the first line?

I noticed an empty comment block in the JSONP output returned by the facebook api graph for all methods.

URL I called:

https://graph.facebook.com/NUMERIC_FACEBOOK_ID/friends?access_token=ACCESS_TOKEN_STRING&callback=theGreatFunction

JSONP Output:

/**/ theGreatFunction({
   "data": [
      {
         "name": "First Friend",
         "id": "XXXX"
      },
      {
         "name": "Second Friend",
         "id": "XXXXXX"
      },
     ........

My question is: what is an empty comment block /* */in front of the callback function? Does it have a peculiar purpose? Does it fix any known javascript access?

+5
source share
2 answers

We added this to protect against attacks when a third-party site bypasses the response content type by doing:

<object type="application/x-shockwave-flash"
 data="http://graph.facebook.com?callback=[specifically crafted flash bytes]">
</object>

Google - , , //... +\n (, http://www.google.com/calendar/feeds/developer-calendar@google.com/public/full?alt=json&callback=foo)

+14

, - . , Facebook , , , .:)

-1

All Articles