如何使用ajax从php返回一个javascript对象

I've been on this for hours already, I've read tons of articles and still cant figure it out. Here's the deal.

I am working with Chrome extensions and I want to do a call to my server that returns me a js object. I dont want to inject this into the page, but I want to be able to use it within my content script.

NOTE: I cannot use eval() (I have tried though) and I cannot use jsonp

I am using a framework so my headers arent set here, but they set to return application-type application/javascript utf-8;

my php side looks like this:

$refererObj = 'var refererObj = {
        myFunc: function () {
           console.log("hello");
        }
    };';
echo $refererObj;

my js looks like this

$.ajax({
            url: myUrl,
            crossDomain: true,
            data: postData,
            dataType: "json",
            type: "POST",
            }).done(function(data){
                eval(data);
                console.log(data);
                console.log(refererObj);
            });

The first console.log gives ["var refererObj = {↵ getProducts: function () {↵…(products);↵ console.log("hello");↵ }↵};"]

The second gives "Uncaught ReferenceError: refererObj is not defined"

I get the response as a string with the javascript object and everything is all good until I actually want to "convert" the string into a usable code.

Any help would be really great.

Thanks

  1. You actually can use eval() if you relax the default Content Security Policy with unsafe-eval. But it's a big hammer that's best avoided.

  2. You can use JSONP, again, if you can serve it off an https server and add it to script-src of the Content Security Policy. This is slightly less of a security risk.

I doubt there is any other solution: anything you load off an external server is to be considered tainted and if you find a way to execute it - congrats, you just bypassed CSP in Chrome and should go claim your bug bounty.

Please note that in case of simply JSON data it's all moot, you can just load it with XHR and JSON.parse it. But your example contains code.