Fix #59 - restrict characters allowed in callback parameter

sockjs · Apr 24, 2012 · 8f64d46 · 8f64d46
1 parent c54fb97
commit 8f64d46
Show file tree

Hide file tree

Showing 2 changed files with 13 additions and 0 deletions.
diff --git a/src/trans-htmlfile.coffee b/src/trans-htmlfile.coffee
@@ -45,6 +45,13 @@ exports.app =
                 message: '"callback" parameter required'
             }
         callback = if 'c' of req.query then req.query['c'] else req.query['callback']
+        if /[^a-zA-Z0-9-_.]/.test(callback)
+            throw {
+                status: 500
+                message: 'invalid "callback" parameter'
+            }
+
+
         res.setHeader('Content-Type', 'text/html; charset=UTF-8')
         res.writeHead(200)
         res.write(iframe_template.replace(/{{ callback }}/g, callback));

diff --git a/src/trans-jsonp.coffee b/src/trans-jsonp.coffee
@@ -29,6 +29,12 @@ exports.app =
             }
 
         callback = if 'c' of req.query then req.query['c'] else req.query['callback']
+        if /[^a-zA-Z0-9-_.]/.test(callback)
+            throw {
+                status: 500
+                message: 'invalid "callback" parameter'
+            }
+
         res.setHeader('Content-Type', 'application/javascript; charset=UTF-8')
         res.writeHead(200)