So I sit down tonight to make some layout changes to a client’s website. The changes were minor, moving a form from the bottom of the page to the top and shifting some data around. No big deal, right? The code in question involves some external javascript code supplied by a third-party vendor. No big deal, I thought. Famous last words.
I move the code around and refresh the page. There is significant lag while the browser tries to render the form. Odd, I think, but maybe the server the javascript is being pulled from is slow. Better to pull the javascript local, right? I pull the code down and crack it open, with the intent of either embedding it directly in the page or at least pull it from a local file.
Holy shit what a disaster.
The file consisted of 5 lines of code, only one of which was actually necessary. The problem was that the single line was approximately 46,838 characters long. Yes, you read that right: 46,838 characters.
Let this serve as a public plea to anyone who develops web applications in any form: For the love of all that is sacred, never, ever, neglect the endline. Endline characters are my friend. They should be your friend, too. If you can’t grasp the fact that an application, especially a web browser, might have problems handling FOURTY SIX THOUSAND characters without a line break, then I have one favor to ask: find a new line of work. People like you make it more difficult for people like me to do my job. Sure, I get to play the part of hero when I show my client their “new and improved website” that loads an order of magnitude faster because I simply applied sane whitespace rules. At the end of the day, however, I would rather spend my time doing my job and not cleaning up your crap.
The title of this article should be "Catch a BRAIN, people."Soko
Did the code look anything like this?
The lack of lines was probably accompanied by poorly named, non descript variables. It is probably a weak attempt at obfuscation.
Have fun with the deobfuscation.
Sadly, no. The code wasn’t obfuscicated (it was just outputing HTML. It’s clear that their coldfusion script was just looping through some data to build a document.write. Honestly, how hard is it to add a break in there to do multiple document.writes, so your lines are a reasonable length? This was purely a rookie mistake.
It’s not just code. In my job as a sysadmin, I get to occasionally deal with our “webmasters” for stuff like DNS entries. It never ceases to amaze me how little these people know about the infrastructure that makes their sites work. Just yesterday I had to explain to one of them how virtual hosts work on a webserver (NO! I can’t make http://www.foobar.com point to http://123.213.111.222/dir/newsite/ via DNS). Conversations like this happen far too regularly for my liking.
Anyway Adam, it’s losers like this that will keep you employed, as people inevitably gravitate towards techos that “get it”. 🙂
–Matt ;^]
awesome