Page MenuHomePhabricator

gerrit.wm.o/r/changes/ has leading garbage in the output
Closed, InvalidPublic

Description

The output from https://gerrit.wikimedia.org/r/changes has a leading )]}' in the output. E.g.:

$ curl -sS 'https://gerrit.wikimedia.org/r/changes/?q=616846&o=CURRENT_REVISION' | head -n 10
)]}'
[
  {
    "id": "operations%2Fsoftware%2Fwmfmariadbpy~master~I68bb5d2528c58d2e050338ae0e364df90ddf6321",
    "project": "operations/software/wmfmariadbpy",
    "branch": "master",
    "topic": "debians",
    "hashtags": [],
    "change_id": "I68bb5d2528c58d2e050338ae0e364df90ddf6321",
    "subject": "Create debian packages.",

This causes json parsing to fail.

Event Timeline

From https://gerrit-review.googlesource.com/Documentation/rest-api.html#output

To prevent against Cross Site Script Inclusion (XSSI) attacks, the JSON response body starts with a magic prefix line that must be stripped before feeding the rest of the response body to a JSON parser:

)]}'
[ ... valid JSON ... ]
herron triaged this task as Medium priority.Jul 31 2020, 7:00 PM
greg subscribed.

Boldly marking as invalid as this seems to be intended behavior.

Change 621690 had a related patch set uploaded (by Jbond; owner: John Bond):
[operations/puppet@production] pcc.py: fix comment about gerrit magic XSSI prefix

https://gerrit.wikimedia.org/r/621690

Change 621690 merged by Jbond:
[operations/puppet@production] pcc.py: fix comment about gerrit magic XSSI prefix

https://gerrit.wikimedia.org/r/621690