F5 Sites
  • F5.com
  • F5 Labs
  • MyF5
  • NGINX
  • Partner Central
  • Education Services Portal (ESP)
Contact
  • Under Attack?
  • F5 Support
  • DevCentral Support
  • F5 Sales
  • NGINX Sales
  • F5 Professional Services
Skip to contentBrand Logo
Forums
CrowdSRC
Articles
GroupsEventsSuggestionsHow Do I...?
RegisterSign In
  1. DevCentral
  2. Articles
  3. Technical Articles

A Billion More Laughs: The JavaScript hack that acts like an XML attack

Don is off in Lowell working on a project with our ARX folks so I was working late last night (finishing my daily read of the Internet) and ended up reading Scott Hanselman's discussion of threads ve...
Published Sep 11, 2008
Version 1.0
ajax
application
applications
arx
ASM Advanced WAF
chrome
dev
exploits
http
ie8
Lori_MacVittie's avatar
Lori_MacVittie
Icon for Employee rankEmployee
Joined October 17, 2006
View Profile
Lori_MacVittie's avatar
Lori_MacVittie
Icon for Employee rankEmployee
Sep 12, 2008
@7rans

 

 

That's a great point. I was actually thinking about that late yesterday. If you control the parsing, you control the stack, so you control how many iterations of the same piece of code is executed. Doesn't seem like rocket science at all.

 

 

I say that blithely because *I* don't have to implement it. ;-) I seem to recall that writing compilers was ... interesting if not a bit frustrating.

 

Help guide the future of your DevCentral Community!

What tools do you use to collaborate? (1min - anonymous)

ABOUT DEVCENTRAL

DevCentral NewsTechnical ForumTechnical ArticlesTechnical CrowdSRCCommunity GuidelinesDevCentral EULAGet a Developer Lab LicenseBecome a DevCentral MVP

RESOURCES

Product DocumentationWhite PapersGlossaryCustomer StoriesWebinarsFree Online CoursesTraining & Certification

SUPPORT

Manage SubscriptionsProfessional ServicesCreate a Service RequestSoftware DownloadsSupport Portal

PARTNERS

Find a Reseller PartnerTechnology AlliancesBecome an F5 PartnerLogin to Partner Central

©2026 F5, Inc. All rights reserved.
TrademarksPoliciesPrivacyCalifornia PrivacyDo Not Sell My Personal Information