WordPress.org

Make WordPress Core


Ignore:
Timestamp:
06/06/2016 09:33:30 PM (4 years ago)
Author:
rachelbaker
Message:

REST API: Create the general wp_check_jsonp_callback() function for validating JSONP callback functions.

Move the REST API JSONP callback validation check into a separate function named wp_check_jsonp_callback(). This allows plugins to use the built-in validation when handling JSONP callbacks.
Extremely Important Note: If you send JSONP in your custom response, make sure you prefix the response with /**/. This will mitigate the Rosetta Flash exploit. You should also send the X-Content-Type-Options:nosniff header, or even better, use the REST API infrastructure.

Props rmccue.
Fixes #28523.

File:
1 edited

Legend:

Unmodified
Added
Removed
  • trunk/tests/phpunit/tests/rest-api.php

    r36831 r37646  
    323323    }
    324324
     325    public function jsonp_callback_provider() {
     326        return array(
     327            // Standard names
     328            array( 'Springfield', true ),
     329            array( 'shelby.ville', true ),
     330            array( 'cypress_creek', true ),
     331            array( 'KampKrusty1', true ),
     332
     333            // Invalid names
     334            array( 'ogden-ville', false ),
     335            array( 'north haverbrook', false ),
     336            array( "Terror['Lake']", false ),
     337            array( 'Cape[Feare]', false ),
     338            array( '"NewHorrorfield"', false ),
     339            array( 'Scream\\ville', false ),
     340        );
     341    }
     342
     343    /**
     344     * @dataProvider jsonp_callback_provider
     345     */
     346    public function test_jsonp_callback_check( $callback, $valid ) {
     347        $this->assertEquals( $valid, wp_check_jsonp_callback( $callback ) );
     348    }
     349
    325350}
Note: See TracChangeset for help on using the changeset viewer.