Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat: add SecureJSON func to prevent json hijacking #987

Merged
merged 1 commit into from
Jul 8, 2017

Conversation

easonlin404
Copy link
Contributor

@easonlin404 easonlin404 commented Jul 7, 2017

Implement #433, SecureJSON default prepends "while(1)," to response body if the given struct is array values. Examples are shown below:

package main

import (
	"github.com/gin-gonic/gin"
	"net/http"

)
func main() {
	r := gin.Default()
	// r.SecureJsonPrefix(")]}',\n")  // Default "while(1);"

	r.GET("/someJSON", func(c *gin.Context) {
		fruit := []string{"apple", "peach", "pear"}

		// Will output  :   while(1);["apple","peach","pear"]
		c.SecureJSON(http.StatusOK, fruit)
	})
	
	r.Run(":8080")
}

Please review and advise, thanks.

@codecov
Copy link

codecov bot commented Jul 7, 2017

Codecov Report

Merging #987 into master will increase coverage by 0.01%.
The diff coverage is 100%.

Impacted file tree graph

@@            Coverage Diff             @@
##           master     #987      +/-   ##
==========================================
+ Coverage   96.51%   96.52%   +0.01%     
==========================================
  Files          16       16              
  Lines        1406     1412       +6     
==========================================
+ Hits         1357     1363       +6     
  Misses         39       39              
  Partials       10       10
Impacted Files Coverage Δ
gin.go 91.74% <100%> (+0.16%) ⬆️
context.go 96.31% <100%> (+0.02%) ⬆️

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 0c3726b...75ed286. Read the comment docs.

@javierprovecho javierprovecho merged commit c4249f9 into gin-gonic:master Jul 8, 2017
@javierprovecho
Copy link
Member

@easonlin404 thanks! 😄

@javierprovecho javierprovecho added this to the 1.3 milestone Jul 8, 2017
@easonlin404 easonlin404 deleted the secure-json branch July 8, 2017 13:56
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

2 participants