WordPress.org

Make WordPress Core


Ignore:
Timestamp:
06/06/2016 09:33:30 PM (4 years ago)
Author:
rachelbaker
Message:

REST API: Create the general wp_check_jsonp_callback() function for validating JSONP callback functions.

Move the REST API JSONP callback validation check into a separate function named wp_check_jsonp_callback(). This allows plugins to use the built-in validation when handling JSONP callbacks.
Extremely Important Note: If you send JSONP in your custom response, make sure you prefix the response with /**/. This will mitigate the Rosetta Flash exploit. You should also send the X-Content-Type-Options:nosniff header, or even better, use the REST API infrastructure.

Props rmccue.
Fixes #28523.

File:
1 edited

Legend:

Unmodified
Added
Removed
  • trunk/src/wp-includes/functions.php

    r37543 r37646  
    31063106
    31073107/**
     3108 * Check that a JSONP callback is a valid JavaScript callback.
     3109 *
     3110 * Only allows alphanumeric characters and the dot character in callback
     3111 * function names. This helps to mitigate XSS attacks caused by directly
     3112 * outputting user input.
     3113 *
     3114 * @since 4.6.0
     3115 *
     3116 * @param string $callback Supplied JSONP callback function.
     3117 * @return bool True if valid callback, otherwise false.
     3118 */
     3119function wp_check_jsonp_callback( $callback ) {
     3120    if ( ! is_string( $callback ) ) {
     3121        return false;
     3122    }
     3123
     3124    $jsonp_callback = preg_replace( '/[^\w\.]/', '', $callback, -1, $illegal_char_count );
     3125
     3126    return 0 === $illegal_char_count;
     3127}
     3128
     3129/**
    31083130 * Retrieve the WordPress home page URL.
    31093131 *
Note: See TracChangeset for help on using the changeset viewer.