Gouri Sankar A created WW-5845:
----------------------------------
Summary: JSONP callback parameter is concatenated into the
response with no identifier validation
Key: WW-5845
URL: https://issues.apache.org/jira/browse/WW-5845
Project: Struts 2
Issue Type: Bug
Components: Plugin - JSON
Affects Versions: 7.4.0, 7.3.0, 7.0.0, 6.12.0
Reporter: Gouri Sankar A
Both JSONResult.addCallbackIfApplicable and
JSONInterceptor.addCallbackIfApplicable (plugins/json) build the JSONP wrapper
as callbackName + "(" + json + ")", where callbackName is the raw, unvalidated
value of the configured callbackParameter query parameter -- no character
restriction of any kind. This is reachable simply by using the documented
callbackParameter feature as intended; no misconfiguration or opt-out of an
existing control is required.
Every production JSONP implementation validates the callback name against a
JS-identifier pattern before using it, precisely because the wrapped response
is meant to be loaded as <script src=...>. An unvalidated callback means
arbitrary attacker-chosen text is written unescaped immediately before the JSON
body in a script-executing response context -- not just a differently-named
callback function.
Proposal: a shared JSONUtil.isValidJsonpCallbackName() check
(^[A-Za-z_$][A-Za-z0-9_$]*(\.[A-Za-z_$][A-Za-z0-9_$]*)*$, length capped at 128)
applied at both call sites. An invalid callback name falls back to the
unwrapped JSON response, logged at WARN.
Tests: JSONUtilTest#testIsValidJsonpCallbackName covers the shared helper
directly. JSONResultTest#testJSONPCallbackMustBeValidIdentifier proves the fix
at the response level with a benign marker value, confirming the raw parameter
text is absent from the output; confirmed to fail without the fix (reverted in
isolation) with a genuine assertion mismatch, not a compile error. Existing
JSONResultTest, JSONUtilTest and JSONInterceptorTest all pass with the patch
applied; full plugins/json suite: 179/0 failures.
Affected versions: the same unguarded callbackName + "(" + json + ")"
concatenation, at both call sites, is present unchanged in the 6.12.0, 7.0.0,
7.3.0 and 7.4.0 tags, by source inspection.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
