Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

JsonResponse setCallback throws InvalidArgumentException on valid callback #17923

Closed
Spaggel opened this issue Feb 25, 2016 · 3 comments
Closed

Comments

@Spaggel
Copy link

Spaggel commented Feb 25, 2016

Using Symfony 3.0, trying to set a callback on a JsonResponse fails for the following callback: Utils.callbacks[1].

The pattern in setCallback ^[$_\p{L}] $_\p{L}\p{Mn}\p{Mc}\p{Nd}\p{Pc}\x{200C}\x{200D}]*+$/u fails on anything containing brackets while this could be a valid callback.

This works for me ^[$_\p{L}][$_\p{L}\p{Mn}\p{Mc}\p{Nd}\p{Pc}\.]*+(\x{5b}\S+\x{5d})*$. This allows callbacks like foo.bar[1] but not foo.bar[].

@xabbuh
Copy link
Member

xabbuh commented Feb 25, 2016

Can you provide an example that fails for you?

Edit: Never mind, i missed the part where you mentioned it in the description.

@stof
Copy link
Member

stof commented Feb 25, 2016

See https://github.com/willdurand/JsonpCallbackValidator for the implementation of the proper validation to accept valid callbacks

@Spaggel
Copy link
Author

Spaggel commented Feb 25, 2016

I'm requesting mywebsite.com/function?callback=L.OWM.Utils.callbacks[9].

My function does this (cut a lot of crap on the ....)
$callback = $request->get('callback'); ...... $response = new JsonResponse($result); $response->setCallback($callback); return $response;

But it's giving me an InvalidArgumentException on the part callbacks[9] in the setCallback().

Is this example enough?

fabpot added a commit that referenced this issue Oct 5, 2016
This PR was submitted for the master branch but it was merged into the 2.7 branch instead (closes #20127).

Discussion
----------

[HttpFoundation] JSONP callback validation

| Q             | A
| ------------- | ---
| Branch?       | "master"
| Bug fix?      | yes
| New feature?  | yes
| BC breaks?    | no
| Deprecations? | no
| Tests pass?   | yes
| Fixed tickets | #17923
| License       | MIT
| Doc PR        | reference to the documentation PR, if any

Maybe this is too small for a new dep, but at least it's stable. Symfony itself will make no assumption on validation by default, ie. things should keep working as usual.

Commits
-------

1159f8b [HttpFoundation] JSONP callback validation
@fabpot fabpot closed this as completed Oct 5, 2016
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

6 participants