gistfile1.js

/* Parse JSON hijacking protected strings: while(1);{ "foo": 1 } */

(function() {
    var SECURITY_REG_EXP   = /^while\(1\);([\s\S]*)\s*$/,
        ORIGINAL_PARSEJSON = $.parseJSON;

    $.extend($, {
        stripSecurity: function(string) {
            return string.replace(SECURITY_REG_EXP, "$1");
        },

        parseJSON: function(string) {
            return ORIGINAL_PARSEJSON($.stripSecurity(string));
        },
    });

    $.ajaxSetup({
        dataFilter: function(data, type) {
            return type === "json" ? $.stripSecurity(data) : data;
        }
    });
}());