[
https://issues.apache.org/jira/browse/WW-5845?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Lukasz Lenart updated WW-5845:
------------------------------
Fix Version/s: 7.5.0
> JSONP callback parameter is concatenated into the response with no identifier
> validation
> ----------------------------------------------------------------------------------------
>
> Key: WW-5845
> URL: https://issues.apache.org/jira/browse/WW-5845
> Project: Struts 2
> Issue Type: Bug
> Components: Plugin - JSON
> Affects Versions: 6.12.0, 7.0.0, 7.3.0, 7.4.0
> Reporter: Gouri Sankar A
> Priority: Major
> Fix For: 7.5.0
>
> Time Spent: 10m
> Remaining Estimate: 0h
>
> Both JSONResult.addCallbackIfApplicable and
> JSONInterceptor.addCallbackIfApplicable (plugins/json) build the JSONP
> wrapper as callbackName + "(" + json + ")", where callbackName is the raw,
> unvalidated value of the configured callbackParameter query parameter -- no
> character restriction of any kind. This is reachable simply by using the
> documented callbackParameter feature as intended; no misconfiguration or
> opt-out of an existing control is required.
> Every production JSONP implementation validates the callback name against a
> JS-identifier pattern before using it, precisely because the wrapped response
> is meant to be loaded as <script src=...>. An unvalidated callback means
> arbitrary attacker-chosen text is written unescaped immediately before the
> JSON body in a script-executing response context -- not just a
> differently-named callback function.
> Proposal: a shared JSONUtil.isValidJsonpCallbackName() check
> (^[A-Za-z_$][A-Za-z0-9_$]*(\.[A-Za-z_$][A-Za-z0-9_$]*)*$, length capped at
> 128) applied at both call sites. An invalid callback name falls back to the
> unwrapped JSON response, logged at WARN.
> Tests: JSONUtilTest#testIsValidJsonpCallbackName covers the shared helper
> directly. JSONResultTest#testJSONPCallbackMustBeValidIdentifier proves the
> fix at the response level with a benign marker value, confirming the raw
> parameter text is absent from the output; confirmed to fail without the fix
> (reverted in isolation) with a genuine assertion mismatch, not a compile
> error. Existing JSONResultTest, JSONUtilTest and JSONInterceptorTest all pass
> with the patch applied; full plugins/json suite: 179/0 failures.
> Affected versions: the same unguarded callbackName + "(" + json + ")"
> concatenation, at both call sites, is present unchanged in the 6.12.0, 7.0.0,
> 7.3.0 and 7.4.0 tags, by source inspection.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
