Skip to content

Commit 22dc980

Browse files
committed
1 parent 175cc31 commit 22dc980

File tree

2 files changed

+12
-5
lines changed

2 files changed

+12
-5
lines changed

rest/jsonp.go

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -70,8 +70,10 @@ func (w *jsonpResponseWriter) WriteJson(v interface{}) error {
7070
if err != nil {
7171
return err
7272
}
73-
// TODO add "/**/" ?
74-
w.Write([]byte(w.callbackName + "("))
73+
// JSONP security fix (http://miki.it/blog/2014/7/8/abusing-jsonp-with-rosetta-flash/)
74+
w.Header().Set("Content-Disposition", "filename=f.txt")
75+
w.Header().Set("X-Content-Type-Options", "nosniff")
76+
w.Write([]byte("/**/" + w.callbackName + "("))
7577
w.Write(b)
7678
w.Write([]byte(")"))
7779
return nil

rest/jsonp_test.go

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,9 @@
11
package rest
22

33
import (
4-
"github.com/ant0ine/go-json-rest/rest/test"
54
"testing"
5+
6+
"github.com/ant0ine/go-json-rest/rest/test"
67
)
78

89
func TestJsonpMiddleware(t *testing.T) {
@@ -33,10 +34,14 @@ func TestJsonpMiddleware(t *testing.T) {
3334
recorded := test.RunRequest(t, handler, test.MakeSimpleRequest("GET", "http://localhost/ok?callback=parseResponse", nil))
3435
recorded.CodeIs(200)
3536
recorded.HeaderIs("Content-Type", "text/javascript")
36-
recorded.BodyIs("parseResponse({\"Id\":\"123\"})")
37+
recorded.HeaderIs("Content-Disposition", "filename=f.txt")
38+
recorded.HeaderIs("X-Content-Type-Options", "nosniff")
39+
recorded.BodyIs("/**/parseResponse({\"Id\":\"123\"})")
3740

3841
recorded = test.RunRequest(t, handler, test.MakeSimpleRequest("GET", "http://localhost/error?callback=parseResponse", nil))
3942
recorded.CodeIs(500)
4043
recorded.HeaderIs("Content-Type", "text/javascript")
41-
recorded.BodyIs("parseResponse({\"Error\":\"jsonp error\"})")
44+
recorded.HeaderIs("Content-Disposition", "filename=f.txt")
45+
recorded.HeaderIs("X-Content-Type-Options", "nosniff")
46+
recorded.BodyIs("/**/parseResponse({\"Error\":\"jsonp error\"})")
4247
}

0 commit comments

Comments
 (0)