Filter JSON response on a jQuery ajax request, for XSS text

Question

I am falling into a silly issue where the server is giving JSON response with XSS safe text added.

The server gives only 2 kinds of response:

1. HTML page with hidden input field that contains the value I want
2. JSON String with the value which can be preferably converted to JS Object.

The problem is, for preventing JavaScript XSS attacks, the JSON response is made like this:

while(1);{
    "name": {
        "abc": "123",
        ...
        }
    }

So this goes to parseerror in jQuery ajax method and therefore in the error callback.

How do I fix this?

Also, I tried putting a hook in the error function and change the JSON data:

error: function(jqXHR) {
    removeJSCode (jqXHR.responseText);
}

// ...

function removeJSCode(json) {
    .. Code to filter the response
}

But this does not work.

Answer 1

jQuery's $.ajax has dataFilter property in its configuration. Pass it a function and it runs after jQuery receives ajax data, but before jQuery has a chance to touch it.

The function is provided the string response as first argument and data type as second argument. The second argument will depend if you passed dataType in the configuration.

There, you can use .replace('while(1);','') and return the string from the function for jQuery to parse.

$.ajax({
    ...
    dataType : 'json',
    dataFilter : function(response,type){
      //if not JSON, don't do anything with it
      if(type !== 'json') return response;
      //otherwise, replace and return
      return response.replace('while(1);','');
    }
    ...
});