Commit 209b0b6e authored by Lukas Fleischer's avatar Lukas Fleischer
Browse files

Mitigate JSONP callback vulnerabilities

The callback parameter of the RPC interface currently allows for
specifying a prefix of arbitrary length of the returned result. This can
be exploited by certain attacks.

As a countermeasure, this patch restricts the allowed character set for
the callback name to letters, digits, underscores, parenthesis and dots.
It also limits the length of the name to 128 characters. Furthermore,
the reflected callback name is now always prepended with "/**/", which
is a common workaround to protect against attacks such as Rosetta Flash.

Fixes FS#46259.

Signed-off-by: Lukas Fleischer's avatarLukas Fleischer <>
parent ee9a8f23
......@@ -110,9 +110,13 @@ class AurJSON {
if (isset($http_data['callback'])) {
$callback = $http_data['callback'];
if (isset($callback)) {
if (!preg_match('/^[a-zA-Z0-9().]{1,128}$/D', $callback)) {
return $this->json_error('Invalid callback name.');
header('content-type: text/javascript');
return $http_data['callback'] . "({$json})";
return '/**/' . $callback . '(' . $json . ')';
} else {
header('content-type: application/json');
return $json;
Supports Markdown
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment