rootvector2 commented on PR #3628:
URL: https://github.com/apache/cxf/pull/3628#issuecomment-6436093627
Pushed the changes.
1. The check now runs in `handleMessage` right before
`exchange.put(CALLBACK_KEY, ...)`, so an overridden `getCallbackValue` is
covered too (and so is a custom `defaultCallback`).
2. Added `setCallbackPattern` on `JsonpInInterceptor`, default
`[A-Za-z0-9_$.]{1,128}`; a deployment with flat names can drop the dot.
`JsonpPreStreamInterceptor` and `JsonpJaxrsWriterInterceptor` now write `/**/`
ahead of the callback and set `X-Content-Type-Options: nosniff` next to the
content type.
3. Length cap is in the default pattern, with a test for a 129 character
name.
4. Ignoring was deliberate: plain JSON for the same resource is still a
correct answer, and it keeps the interceptor out of the fault path, same as
when `_jsonp` is absent. I can switch it to a 400 if you'd rather have it
visible.
5. Added `testJsonWithInvalidCallbackAndJsonpAccept`: invalid `_jsonp` plus
`Accept: application/x-javascript` leaves the exchange without a callback and
writes no padding.
`testGetBookJsonp` and `testGetBookJsonpJackson` in the systests now expect
the `/**/` prefix and the `nosniff` header; both pass end to end.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
