WordPress.org

Make WordPress Core


Ignore:
Timestamp:
06/06/2016 09:33:30 PM (4 years ago)
Author:
rachelbaker
Message:

REST API: Create the general wp_check_jsonp_callback() function for validating JSONP callback functions.

Move the REST API JSONP callback validation check into a separate function named wp_check_jsonp_callback(). This allows plugins to use the built-in validation when handling JSONP callbacks.
Extremely Important Note: If you send JSONP in your custom response, make sure you prefix the response with /**/. This will mitigate the Rosetta Flash exploit. You should also send the X-Content-Type-Options:nosniff header, or even better, use the REST API infrastructure.

Props rmccue.
Fixes #28523.

File:
1 edited

Legend:

Unmodified
Added
Removed
  • trunk/src/wp-includes/rest-api/class-wp-rest-server.php

    r37490 r37646  
    281281            }
    282282
    283             // Check for invalid characters (only alphanumeric allowed).
    284             if ( is_string( $_GET['_jsonp'] ) ) {
    285                 $jsonp_callback = preg_replace( '/[^\w\.]/', '', wp_unslash( $_GET['_jsonp'] ), -1, $illegal_char_count );
    286                 if ( 0 !== $illegal_char_count ) {
    287                     $jsonp_callback = null;
    288                 }
    289             }
    290             if ( null === $jsonp_callback ) {
     283            $jsonp_callback = $_GET['_jsonp'];
     284            if ( ! wp_check_jsonp_callback( $jsonp_callback ) ) {
    291285                echo $this->json_error( 'rest_callback_invalid', __( 'The JSONP callback function is invalid.' ), 400 );
    292286                return false;
Note: See TracChangeset for help on using the changeset viewer.