$xhr service now autodetects and strips )]}',\n

")]}\',\n" is a commonly used security prefix added to json http
responses iat google and elsewhere in order to prevent certain
cross-site attacks

$xhr service now autodetects the prefix and strips it before
deserializing the json.

the implementation should be more flexible to allow for wider range
of prefixes, but we need this one right now and can address other
usecases later.

1 files changed, 39 insertions, 0 deletions

diff --git a/test/service/xhrSpec.js b/test/service/xhrSpec.js
index 35861a92..fc51eff2 100644
--- a/test/service/xhrSpec.js
+++ b/test/service/xhrSpec.js
@@ -44,4 +44,43 @@ describe('$xhr', function() {
 
     expect($log.error).wasCalledWith("MyException");
   });
+
+
+  it('should automatically deserialize json objects', function() {
+    var response;
+
+    $browserXhr.expectGET('/foo').respond('{"foo":"bar","baz":23}');
+    $xhr('GET', '/foo', function(code, resp) {
+      response = resp;
+    });
+    $browserXhr.flush();
+
+    expect(response).toEqual({foo:'bar', baz:23});
+  });
+
+
+  it('should automatically deserialize json arrays', function() {
+    var response;
+
+    $browserXhr.expectGET('/foo').respond('[1, "abc", {"foo":"bar"}]');
+    $xhr('GET', '/foo', function(code, resp) {
+      response = resp;
+    });
+    $browserXhr.flush();
+
+    expect(response).toEqual([1, 'abc', {foo:'bar'}]);
+  });
+
+
+  it('should automatically deserialize json with security prefix', function() {
+    var response;
+
+    $browserXhr.expectGET('/foo').respond(')]}\',\n[1, "abc", {"foo":"bar"}]');
+    $xhr('GET', '/foo', function(code, resp) {
+      response = resp;
+    });
+    $browserXhr.flush();
+
+    expect(response).toEqual([1, 'abc', {foo:'bar'}]);
+  });
 });