JSONP security fix (http://miki.it/blog/2014/7/8/abusing-jsonp-with-rosetta-flash/)

Author: sebest

rest/jsonp.go

@@ -70,8 +70,10 @@ func (w *jsonpResponseWriter) WriteJson(v interface{}) error {
 	if err != nil {
 		return err
 	}
-	// TODO add "/**/" ?
-	w.Write([]byte(w.callbackName + "("))
+	// JSONP security fix (http://miki.it/blog/2014/7/8/abusing-jsonp-with-rosetta-flash/)
+	w.Header().Set("Content-Disposition", "filename=f.txt")
+	w.Header().Set("X-Content-Type-Options", "nosniff")
+	w.Write([]byte("/**/" + w.callbackName + "("))
 	w.Write(b)
 	w.Write([]byte(")"))
 	return nil

rest/jsonp_test.go

@@ -1,8 +1,9 @@
 package rest
 
 import (
-	"github.com/ant0ine/go-json-rest/rest/test"
 	"testing"
+
+	"github.com/ant0ine/go-json-rest/rest/test"
 )
 
 func TestJsonpMiddleware(t *testing.T) {
@@ -33,10 +34,14 @@ func TestJsonpMiddleware(t *testing.T) {
 	recorded := test.RunRequest(t, handler, test.MakeSimpleRequest("GET", "http://localhost/ok?callback=parseResponse", nil))
 	recorded.CodeIs(200)
 	recorded.HeaderIs("Content-Type", "text/javascript")
-	recorded.BodyIs("parseResponse({\"Id\":\"123\"})")
+	recorded.HeaderIs("Content-Disposition", "filename=f.txt")
+	recorded.HeaderIs("X-Content-Type-Options", "nosniff")
+	recorded.BodyIs("/**/parseResponse({\"Id\":\"123\"})")
 
 	recorded = test.RunRequest(t, handler, test.MakeSimpleRequest("GET", "http://localhost/error?callback=parseResponse", nil))
 	recorded.CodeIs(500)
 	recorded.HeaderIs("Content-Type", "text/javascript")
-	recorded.BodyIs("parseResponse({\"Error\":\"jsonp error\"})")
+	recorded.HeaderIs("Content-Disposition", "filename=f.txt")
+	recorded.HeaderIs("X-Content-Type-Options", "nosniff")
+	recorded.BodyIs("/**/parseResponse({\"Error\":\"jsonp error\"})")
 }