Changeset 37646 for trunk/tests/phpunit/tests/rest-api.php

Timestamp:

06/06/2016 09:33:30 PM (10 years ago)

Author:

rachelbaker

Message:

REST API: Create the general wp_check_jsonp_callback() function for validating JSONP callback functions.

Move the REST API JSONP callback validation check into a separate function named wp_check_jsonp_callback(). This allows plugins to use the built-in validation when handling JSONP callbacks.
Extremely Important Note: If you send JSONP in your custom response, make sure you prefix the response with /**/. This will mitigate the Rosetta Flash exploit. You should also send the X-Content-Type-Options:nosniff header, or even better, use the REST API infrastructure.

Props rmccue.
Fixes #28523.

File:

• trunk/tests/phpunit/tests/rest-api.php (modified) (1 diff)

trunk/tests/phpunit/tests/rest-api.php

@@ -323 +323 @@
         }
 
+        public function jsonp_callback_provider() {
+                return array(
+                        // Standard names
+                        array( 'Springfield', true ),
+                        array( 'shelby.ville', true ),
+                        array( 'cypress_creek', true ),
+                        array( 'KampKrusty1', true ),
+
+                        // Invalid names
+                        array( 'ogden-ville', false ),
+                        array( 'north haverbrook', false ),
+                        array( "Terror['Lake']", false ),
+                        array( 'Cape[Feare]', false ),
+                        array( '"NewHorrorfield"', false ),
+                        array( 'Scream\\ville', false ),
+                );
+        }
+
+        /**
+         * @dataProvider jsonp_callback_provider
+         */
+        public function test_jsonp_callback_check( $callback, $valid ) {
+                $this->assertEquals( $valid, wp_check_jsonp_callback( $callback ) );
+        }
+
 }