rack-jsonp-middleware 0.0.6 → 0.0.7

data/README.md

@@ -1,14 +1,10 @@
 # rack-jsonp-middleware - ![Travis CI Status](http://travis-ci.org/robertodecurnex/rack-jsonp-middleware.png) - ![Gemnasium Dependencies Status](https://gemnasium.com/robertodecurnex/rack-jsonp-middleware.png)
 
-A Rack JSONP middleware
+Rack middleware that turns all .jsonp requests into a jsonp response. 
 
 ## Overview
 
-This is a customized implementation of a JSONP middleware. 
-
-The main difference with the rest of them is that this one will add JSONP support to any of your JSON calls but only when the extension name '.jsonp' is present.
-
-Since 'callback' is a really generic parameter name if someone wants to get a JSONP response they must request it explicitly.
+(does not support 'callback' since it is a really generic parameter name)
 
 Btw, don't forget to give a try to [J50Nπ](https://github.com/robertodecurnex/J50Npi) (a pure JS JSONP helper), they make a lovely couple together :P
 
@@ -18,8 +14,10 @@ Roberto Decurnex (nex.development@gmail.com)
 
 ## Contributors
 
-* [rwilcox](https://github.com/rwilcox "rwilcox profile")
-* [amiel](https://github.com/amiel "amiel profile")
+* Ryan Wilcox ([rwilcox](https://github.com/rwilcox "rwilcox profile"))
+* Amiel Martin ([amiel](https://github.com/amiel "amiel profile"))
+* Michael Grosser ([grosser](https://github.com/grosser "grosser profile"))
+* Matt Sanford ([mzsanford](https://github.com/mzsanford "mzsanford profile"))
 
 ## Install
 
@@ -79,3 +77,9 @@ But http://domain.com/action.json?callback=J50Npi.sucess will still returns the
     {"key":"value"}
 With the following Content-Type:
     application/json
+
+# Security
+
+Supporting jsonp means that another websites can access your website on behalf of a user visiting their site,
+which might lead to security problems (e.g. they read http://yoursite.com/user.jsonp and get the users email etc),
+so think about if you want to turn it on globally.

data/lib/rack/jsonp.rb

@@ -11,7 +11,7 @@ module Rack
       requesting_jsonp = Pathname(request.env['PATH_INFO']).extname =~ /^\.jsonp$/i
       callback = request.params['callback']
 
-      return [400,{},[]] if requesting_jsonp && !callback
+      return [400,{},[]] if requesting_jsonp && !self.valid_callback?(callback)
 
       if requesting_jsonp
         env['PATH_INFO'].sub!(/\.jsonp/i, '.json')
@@ -20,21 +20,41 @@ module Rack
 
       status, headers, body = @app.call(env)
 
-      if requesting_jsonp && headers['Content-Type'] && headers['Content-Type'].match(/application\/json/i)
+      if requesting_jsonp && self.json_response?(headers['Content-Type'])
         json = ""
         body.each { |s| json << s }
         body = ["#{callback}(#{json});"]
         headers['Content-Length'] = Rack::Utils.bytesize(body[0]).to_s
-        headers['Content-Type'] = force_mime_type(headers['Content-Type'], 'application/javascript')
+        headers['Content-Type'].sub!(/^[^;]+(;?)/, "#{MIME_TYPE}\\1")
       end
 
       [status, headers, body]
     end
 
-    def force_mime_type(content_type, mime_type)
-      content_type_parts = (content_type || '').split(/;/)
-      content_type_parts[0] = mime_type
-      content_type_parts.join(';')
+  protected
+    
+    # Do not allow arbitrary Javascript in the callback.
+    #
+    # @return [Regexp]
+    VALID_CALLBACK_PATTERN = /^[a-zA-Z0-9\._]+$/
+
+    # @return [String] the JSONP response mime type.
+    MIME_TYPE = 'application/javascript'
+
+    # Checks if the callback function name is safe/valid.
+    #
+    # @param [String] callback the string to be used as the JSONP callback function name.
+    # @return [TrueClass|FalseClass]
+    def valid_callback?(callback)
+      !callback.nil? && !callback.match(VALID_CALLBACK_PATTERN).nil?
+    end
+
+    # Check if the response Content Type is JSON.
+    #
+    # @param [Hash] content_type the response Content Type
+    # @return [TrueClass|FalseClass]
+    def json_response?(content_type)
+      !content_type.nil? && !content_type.match(/^application\/json/i).nil?
     end
 
   end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: rack-jsonp-middleware
 version: !ruby/object:Gem::Version
-  version: 0.0.6
+  version: 0.0.7
   prerelease: 
 platform: ruby
 authors:
@@ -9,7 +9,7 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2012-07-31 00:00:00.000000000 Z
+date: 2012-09-12 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rack
@@ -92,3 +92,4 @@ signing_key:
 specification_version: 3
 summary: rack-jsonp-middleware-0.0.5
 test_files: []
+has_rdoc: