[
https://issues.apache.org/jira/browse/WW-5845?focusedWorklogId=1053231&page=com.atlassian.jira.plugin.system.issuetabpanels:worklog-tabpanel#worklog-1053231
]
ASF GitHub Bot logged work on WW-5845:
--------------------------------------
Author: ASF GitHub Bot
Created on: 07/Nov/26 12:42
Start Date: 07/Nov/26 12:42
Worklog Time Spent: 10m
Work Description: g0w6y opened a new pull request, #2121:
URL: https://github.com/apache/struts/pull/2121
Validates JSONP callback names in `JSONResult` and `JSONInterceptor` using a
shared check. Accepts dotted ASCII identifiers up to 128 characters; invalid
names leave the JSON response unwrapped.
Validation: JSON plugin suite passed (179 tests); 42 additional direct
checks passed.
[WW-5845](https://issues.apache.org/jira/browse/WW-5845)
Issue Time Tracking
-------------------
Worklog Id: (was: 1053231)
Remaining Estimate: 0h
Time Spent: 10m
> JSONP callback parameter is concatenated into the response with no identifier
> validation
> ----------------------------------------------------------------------------------------
>
> Key: WW-5845
> URL: https://issues.apache.org/jira/browse/WW-5845
> Project: Struts 2
> Issue Type: Bug
> Components: Plugin - JSON
> Affects Versions: 6.12.0, 7.0.0, 7.3.0, 7.4.0
> Reporter: Gouri Sankar A
> Priority: Major
> Time Spent: 10m
> Remaining Estimate: 0h
>
> Both JSONResult.addCallbackIfApplicable and
> JSONInterceptor.addCallbackIfApplicable (plugins/json) build the JSONP
> wrapper as callbackName + "(" + json + ")", where callbackName is the raw,
> unvalidated value of the configured callbackParameter query parameter -- no
> character restriction of any kind. This is reachable simply by using the
> documented callbackParameter feature as intended; no misconfiguration or
> opt-out of an existing control is required.
> Every production JSONP implementation validates the callback name against a
> JS-identifier pattern before using it, precisely because the wrapped response
> is meant to be loaded as <script src=...>. An unvalidated callback means
> arbitrary attacker-chosen text is written unescaped immediately before the
> JSON body in a script-executing response context -- not just a
> differently-named callback function.
> Proposal: a shared JSONUtil.isValidJsonpCallbackName() check
> (^[A-Za-z_$][A-Za-z0-9_$]*(\.[A-Za-z_$][A-Za-z0-9_$]*)*$, length capped at
> 128) applied at both call sites. An invalid callback name falls back to the
> unwrapped JSON response, logged at WARN.
> Tests: JSONUtilTest#testIsValidJsonpCallbackName covers the shared helper
> directly. JSONResultTest#testJSONPCallbackMustBeValidIdentifier proves the
> fix at the response level with a benign marker value, confirming the raw
> parameter text is absent from the output; confirmed to fail without the fix
> (reverted in isolation) with a genuine assertion mismatch, not a compile
> error. Existing JSONResultTest, JSONUtilTest and JSONInterceptorTest all pass
> with the patch applied; full plugins/json suite: 179/0 failures.
> Affected versions: the same unguarded callbackName + "(" + json + ")"
> concatenation, at both call sites, is present unchanged in the 6.12.0, 7.0.0,
> 7.3.0 and 7.4.0 tags, by source inspection.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
