http://codereview.appspot.com/2206045/diff/21001/src/com/google/caja/cajita-module.js File src/com/google/caja/cajita-module.js (right):
http://codereview.appspot.com/2206045/diff/21001/src/com/google/caja/cajita-module.js#newcode195 src/com/google/caja/cajita-module.js:195: var jsonpCallbackCount = 0; Please move this closer to its single place of use http://codereview.appspot.com/2206045/diff/21001/src/com/google/caja/service/AbstractCajolingHandler.java File src/com/google/caja/service/AbstractCajolingHandler.java (right): http://codereview.appspot.com/2206045/diff/21001/src/com/google/caja/service/AbstractCajolingHandler.java#newcode172 src/com/google/caja/service/AbstractCajolingHandler.java:172: output.append(jsonpCallback + "("); This is vulnerable - jsonpCallback is never checked to be just a function identifier and can be arbitrary js. http://codereview.appspot.com/2206045/diff/21001/src/com/google/caja/service/CajaArguments.java File src/com/google/caja/service/CajaArguments.java (right): http://codereview.appspot.com/2206045/diff/21001/src/com/google/caja/service/CajaArguments.java#newcode40 src/com/google/caja/service/CajaArguments.java:40: JSONP_CALLBACK("jsonp-callback"), We can call this whatever we like but it might be worthwhile calling is "callback" to be compatible with other gdata feeds.. http://codereview.appspot.com/2206045/diff/21001/src/com/google/caja/service/CajaArguments.java#newcode41 src/com/google/caja/service/CajaArguments.java:41: In this or in a separate CL, alt=json and alt=json-in-script as alternatives to input-mime-type. http://codereview.appspot.com/2206045/diff/21001/src/com/google/caja/service/CajolingServlet.java File src/com/google/caja/service/CajolingServlet.java (right): http://codereview.appspot.com/2206045/diff/21001/src/com/google/caja/service/CajolingServlet.java#newcode153 src/com/google/caja/service/CajolingServlet.java:153: resp.setStatus(HttpServletResponse.SC_OK); Ok. Response is always ok if the cajoler ran and output json contains the needed errors. http://codereview.appspot.com/2206045/
