rootvector2 opened a new pull request, #3628:
URL: https://github.com/apache/cxf/pull/3628
`JsonpInInterceptor.getCallbackValue` takes the `_jsonp` query parameter
verbatim (not even URL-decoded) and the out interceptors write it in front of
the JSON body as `application/x-javascript`. Found while auditing the JAX-RS
providers: `GET /books/123?_jsonp=alert(document.domain)//` returns
`alert(document.domain)//({...});`, which is attacker-chosen script served from
the service's own origin, so any HTML injection there can load it with `<script
src>` and get past a `script-src 'self'` CSP.
Only accept callback names made of letters, digits, `_`, `$` and `.`, which
covers plain and dotted callbacks such as `jQuery331_123` or
`angular.callbacks._0`; anything else is ignored and the response stays plain
JSON. The check sits in `JsonpInInterceptor` because
`JsonpPreStreamInterceptor` and `JsonpJaxrsWriterInterceptor` both read the
callback it stores. Added `JsonpInterceptorTest` cases for a rejected and a
dotted callback.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
