Please, may we use square brackets in JSON callbacks?
Closed, ResolvedPublic

Description

Author: kent_brewster

Description:
It would be enormously useful to be able to use square brackets in JSON callbacks, like so:

&callback=foo[4]

... or like so:

&callback=foo%5B4%5D

Thanks very much!


Version: unspecified
Severity: enhancement
URL: http://en.wikipedia.org/w/api.php

bzimport added a project: MediaWiki-API.Via ConduitNov 21 2014, 9:57 PM
bzimport set Reference to bz12136.
bzimport created this task.Via LegacyNov 28 2007, 2:13 AM
Catrope added a comment.Via ConduitNov 29 2007, 2:17 PM

(In reply to comment #0)

It would be enormously useful to be able to use square brackets in JSON
callbacks, like so:

&callback=foo[4]

How in the name of hell can foo[4] (an array element) be a valid JavaScript function? Do you have an array of functions? An array of function pointers? Is that even *possible* in JavaScript?

Closing as INVALID for now.

brion added a comment.Via ConduitDec 6 2007, 6:41 PM

Yes, that's entirely possible in JavaScript. I can't say I'd recommend it for readability purposes, though. :)

bzimport added a comment.Via ConduitDec 6 2007, 7:01 PM

kent_brewster wrote:

Functions can be members of arrays, and their indices are available inside; this comes in handy when you need to know which of many possible responses to an API query you're looking at. Vital for Web apps that might make more than one query to the same API before reloading the page.

Here is some generic code:

// create an empty array:
var ping = [];

// after you've recieved a value for myQuery, create a function to receive results:
var n = ping.length;
ping[n] = function(result) {
   if (result.totalResultsAvailable) {
      alert('Results found: ' + result.totalResultsAvailable);
   } else {
      alert('Nothing found, sorry!');
   }
   var s = document.getElementById(ping[n]);
   if (s !== 'undefined') {
      s.parentNode.removeChild(s);
   }
   delete ping[n];
};

// create an API call
var myCallback= 'ping[' + n + ']';
var url = 'http://your.api.com/?callback=' + myCallback + '&query=' + myQuery;
var s = document.createElement('SCRIPT');
s.id = callback;

// append a script node with the call
document.getElementsByTagName('BODY')[0].appendChild(s);

I have a presentation online here:

http://kentbrewster.com/wiki-widget

... that shows this technique in use, if you're interested.

brion added a comment.Via ConduitDec 6 2007, 7:13 PM

Creeeeeepy... :D

Catrope added a comment.Via ConduitDec 6 2007, 7:47 PM

Even then, can't use just do

var myFunc = funcArr[n];

and use myFunc() as a callback?

bzimport added a comment.Via ConduitMar 20 2008, 6:42 PM

Bryan.TongMinh wrote:

Does this introduce security problems? Do we need to check whether the callback is valid JS?

bzimport added a comment.Via ConduitMar 22 2008, 7:37 PM

kent_brewster wrote:

Roan: yes, but you still need to pass n to funcArr[n], right? Or am I missing something?

Bryan: it's probably already been taken care of in your filtering. As long as you're only allowing integers between those square brackets, you're fine.

If you look at http://developer.yahoo.com/common/json.html, you'll see that one of the world's biggest providers of API data does this with all their calls; so far, nothing bad has happened.

bzimport added a comment.Via ConduitMar 22 2008, 7:56 PM

Bryan.TongMinh wrote:

That basically means that we would have to drop the filtering that is done on the callback parameter. No problems with that as far as I can see. Brion?

brion added a comment.Via ConduitMar 24 2008, 6:59 PM

Well, I might recommend a basic sanity check; returning completely arbitrary input might be used to generate special file download links, say a big ol' EXE file with some junk JSON at the end. :)

Catrope added a comment.Via ConduitMar 24 2008, 7:16 PM

I'm gonna look into this some time this week.

bzimport added a comment.Via ConduitApr 5 2008, 6:54 PM

Bryan.TongMinh wrote:

Fixed in r32822: Extended allowed characters in JSON callback to ][.'"_A-Za-z0-9

Add Comment

Column Prototype
This is a very early prototype of a persistent column. It is not expected to work yet, and leaving it open will activate other new features which will break things. Press "\" (backslash) on your keyboard to close it now.