python - Tornado - JSON Output sent as Response to be wrapped in dictionary -

i came across section in docs :

requesthandler.write(chunk)

writes given chunk output buffer.

to write output network, use flush() method below.

if given chunk dictionary, write json , set content-type of response application/json. (if want send json different content-type, call set_header after calling write()).

note lists not converted json because of potential cross-site security vulnerability. json output should wrapped in dictionary. more details @ http://haacked.com/archive/2009/06/25/json-hijacking.aspx/ , https://github.com/facebook/tornado/issues/1009

so have few questions related this:

1. what mean this?

if given chunk dictionary, write json.

2. what mean this?

note lists not converted json because of potential cross-site security vulnerability.

3. what mean this? , here, mean json output? , why wrap in dictionary?

all json output should wrapped in dictionary.

4. this has 2 subparts :

   a. best way send json responses tornado client?

   b. better way send responses? if not json, is? , if json, mention answer subpart (a).

please try answer parts , subparts in numbered manner can understand them properly.

1. what mean this?

   if given chunk dictionary, write json.

it means, if pass dict write automatically json encoded. method write can handle dict, byte, unicode_type (simplifying str).

2. what mean this?

   note lists not converted json because of potential cross-site security vulnerability.

assume provide service , request /example/my_service/user_data.json , json response.

if top level object array like:

["john smith", "email@mail"] 

then attacker redefine array's constructor , add script tag /example/my_service/user_data.json, gets evaluated - array created attacker's constructor. because standalone array valid javascript code.

since standalone objects, except empty one, not valid js, if return

{"name": "john smith", "email":"email@mail"} 

attacker end syntaxerror: missing ; before statement or similar.

more info http://haacked.com/archive/2008/11/20/anatomy-of-a-subtle-json-vulnerability.aspx/

3. what mean this? , here, mean json output? , why wrap in dictionary?

   all json output should wrapped in dictionary.

as read above, becomes pretty clear, top-level element in json should not array. tornado raise error if pass list.of course can bypass safety, passing string (json dumps before wirte), not wise:

self.write('["this", "is", "wrong"]') 

4. a. best way send json responses tornado client?

   b. better way send responses? if not json, is? , if json, mention answer subpart (a).

i use, if possible, json or xml response. not using tornado's mechanism that, pass encoded object - string write. reason is, it's cleanest way override tornado's encoders , use e.g. ujson.

edit

worth noting modern browsers should not vulnerable.