Last modified: 2008-04-05 18:54:12 UTC

Wikimedia Bugzilla is closed!

Wikimedia has migrated from Bugzilla to Phabricator. Bug reports should be created and updated in Wikimedia Phabricator instead. Please create an account in Phabricator and add your Bugzilla email address to it.
Wikimedia Bugzilla is read-only. If you try to edit or create any bug report in Bugzilla you will be shown an intentional error message.
In order to access the Phabricator task corresponding to a Bugzilla report, just remove "static-" from its URL.
You could still run searches in Bugzilla or access your list of votes but bug reports will obviously not be up-to-date in Bugzilla.
Bug 12136 - Please, may we use square brackets in JSON callbacks?
Please, may we use square brackets in JSON callbacks?
Product: MediaWiki
Classification: Unclassified
API (Other open bugs)
All All
: Normal enhancement (vote)
: ---
Assigned To: Roan Kattouw
Depends on:
  Show dependency treegraph
Reported: 2007-11-28 02:13 UTC by Kent Brewster
Modified: 2008-04-05 18:54 UTC (History)
2 users (show)

See Also:
Web browser: ---
Mobile Platform: ---
Assignee Huggle Beta Tester: ---


Description Kent Brewster 2007-11-28 02:13:16 UTC
It would be enormously useful to be able to use square brackets in JSON callbacks, like so:


... or like so:


Thanks very much!
Comment 1 Roan Kattouw 2007-11-29 14:17:04 UTC
(In reply to comment #0)
> It would be enormously useful to be able to use square brackets in JSON
> callbacks, like so:
> &callback=foo[4]

How in the name of hell can foo[4] (an array element) be a valid JavaScript function? Do you have an array of functions? An array of function pointers? Is that even *possible* in JavaScript?

Closing as INVALID for now.
Comment 2 Brion Vibber 2007-12-06 18:41:52 UTC
Yes, that's entirely possible in JavaScript. I can't say I'd recommend it for readability purposes, though. :)
Comment 3 Kent Brewster 2007-12-06 19:01:15 UTC
Functions can be members of arrays, and their indices are available inside; this comes in handy when you need to know which of many possible responses to an API query you're looking at.  Vital for Web apps that might make more than one query to the same API before reloading the page.  

Here is some generic code:

   // create an empty array:
   var ping = [];

   // after you've recieved a value for myQuery, create a function to receive results:
   var n = ping.length;
   ping[n] = function(result) {
      if (result.totalResultsAvailable) {
         alert('Results found: ' + result.totalResultsAvailable);
      } else {
         alert('Nothing found, sorry!');
      var s = document.getElementById(ping[n]);
      if (s !== 'undefined') {
      delete ping[n];

   // create an API call
   var myCallback= 'ping[' + n + ']';
   var url = '' + myCallback + '&query=' + myQuery;
   var s = document.createElement('SCRIPT'); = callback;
   // append a script node with the call

I have a presentation online here:

... that shows this technique in use, if you're interested.
Comment 4 Brion Vibber 2007-12-06 19:13:44 UTC
Creeeeeepy... :D
Comment 5 Roan Kattouw 2007-12-06 19:47:29 UTC
Even then, can't use just do

var myFunc = funcArr[n];

and use myFunc() as a callback?
Comment 6 Bryan Tong Minh 2008-03-20 18:42:21 UTC
Does this introduce security problems? Do we need to check whether the callback is valid JS?
Comment 7 Kent Brewster 2008-03-22 19:37:10 UTC
Roan:  yes, but you still need to pass n to funcArr[n], right?  Or am I missing something?

Bryan:  it's probably already been taken care of in your filtering.  As long as you're only allowing integers between those square brackets, you're fine.

If you look at, you'll see that one of the world's biggest providers of API data does this with all their calls; so far, nothing bad has happened.
Comment 8 Bryan Tong Minh 2008-03-22 19:56:55 UTC
That basically means that we would have to drop the filtering that is done on the callback parameter. No problems with that as far as I can see. Brion?
Comment 9 Brion Vibber 2008-03-24 18:59:57 UTC
Well, I might recommend a basic sanity check; returning completely arbitrary input might be used to generate special file download links, say a big ol' EXE file with some junk JSON at the end. :)
Comment 10 Roan Kattouw 2008-03-24 19:16:06 UTC
I'm gonna look into this some time this week.
Comment 11 Bryan Tong Minh 2008-04-05 18:54:12 UTC
Fixed in r32822: Extended allowed characters in JSON callback to ][.'"_A-Za-z0-9

Note You need to log in before you can comment on or make changes to this bug.