让我们完全在客户端使用脚本标签解决跨域ajax

发布于 2024-07-13 20:53:13 字数 622 浏览 11 评论 0原文

我知道，有 JSONP，它涉及服务器合作来对数据进行命名空间。

令我困扰的是，脚本标签 src 的内容已被评估，但它不可供读取。

<script src="http://www.google.com"></script>

我们需要弄清楚的是如何命名数据，仅此而已。当然，我尝试了非常愚蠢的事情，但没有相关结果（我知道这不起作用，但你可以看到我想要实现的目标）：

<script>eval('var namespace="');</script>
<script src="http://www.google.com"></script>
<script>eval('";');</script>

因为实际上没有关于 src 如何实现的相关信息内容被评估，我知道它是全局范围的，但是如果我们可以跟踪评估步骤或者可能链以某种方式评估范围（也没有太多关于此的文档），我们可以解决这个恼人的“评估”但不可读”的事情。

有任何想法吗？

原文

I know, there's JSONP, which involves server cooperation to name-space the data.

What is bothering me is the fact that the content of script tag src is evaluated, but it's NOT available to read.

<script src="http://www.google.com"></script>

All we need to figure out is how to namespace the data, that's all.
Of course I tried pretty idiotic things with no relevant result (I know this doesn't work, but you can see what I'm trying to achieve):

<script>eval('var namespace="');</script>
<script src="http://www.google.com"></script>
<script>eval('";');</script>

Since there's really no relevant info on how the src content is evaluated, I know it's global scope, but if we could trace evaluation steps or maybe chain evals scope somehow (not much documentation about this as well), we could solve this annoying "evaluated but not readable" thing.

Any ideas?

分享到QQ

分享到微博

如果你对这篇内容有疑问，欢迎到本站社区发帖提问参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。

发布评论

需要登录才能够评论，你可以免费注册一个本站的账号。

祁梦 2024-07-20 20:53:13

HTML5 提供了 window.postMessage，它提供了一种安全跨域消息传递的机制，并且受到 Firefox 3、Opera 9.6 和 WebKit nightlies 的支持。

也就是说，您上面的建议不起作用，因为它需要与 javascript 的 eval 完全不同的行为。 eval 在当前上下文中解析并执行给定的字符串 - 您所请求的是 eval 更改包含函数的实际代码。例如。

 for (var i = 0; i < 10; i++) eval("; doSomething();");

会变成

 for (var i = 0; i < 10; i++) ; doSomething();;

意味着 for 循环变空，并且 doSomething 只会被调用一次。显然，这将导致难以理解语义，并且大大降低了使用安全性，因为 eval 将获得直接影响控制流的能力。

HTML5 provides window.postMessage which provides a mechanism for safe cross domain messaging, and is supported by Firefox 3, Opera 9.6, and WebKit nightlies.

That said your suggestion above cannot work because it requires fundamentally different behaviour from javascript's eval. eval parses and executes the given string in the current context -- what you're requesting is that eval change the actual code of the containing function. eg.

 for (var i = 0; i < 10; i++) eval("; doSomething();");

would become

 for (var i = 0; i < 10; i++) ; doSomething();;

meaning the for-loop becomes empty, and doSomething would only be called once. Clearly this would result in incredibly difficult to comprehend semantics, as well as making it substantially less safe to use, as eval would gain the ability to directly influence control flow.

回复收藏 0 原文