Do I need to sanitize the callback parameter from a JSONP call?

Posted by christian studer on Stack Overflow See other posts from Stack Overflow or by christian studer
Published on 2010-05-05T21:46:08Z Indexed on 2010/05/06 7:18 UTC
Read the original article Hit count: 265

Filed under:

jsonp

|

xss-prevention

|

xss

I would like to offer a webservice via JSONP and was wondering, if I need to sanitize the value from the callback parameter.

My current server side script looks like this currently (More or less. Code is in PHP, but could be anything really.):

header("Content-type: application/javascript");
echo $_GET['callback'] . '(' . json_encode($data) . ')';

This is a classic XSS-vulnerability.

If I need to sanitize it, then how? I was unable to find enough information about what might be allowed callback strings.

© Stack Overflow or respective owner

Related posts about jsonp

jQuery/JSONP widget and jquery version conflict

as seen on Stack Overflow - Search for 'Stack Overflow'
I would like to create a widget so that my visitors can display it on their blog/website. I would like to use jquery and jsonp to develop this widget. I know how to avoid conflicts between jQuery and other libraries (like prototype). But what will happen if jquery is already installed on my visitors'… >>> More
Why isn't jQuery automatically appending the JSONP callback?

as seen on Stack Overflow - Search for 'Stack Overflow'
The $.getJSON() documentation states: If the specified URL is on a remote server, the request is treated as JSONP instead. See the discussion of the jsonp data type in $.ajax() for more details. The $.ajax() documentation for the jsonp data type states (emphasis mine): Loads in a JSON block… >>> More
Does JSONP scale? How many JSONP requests can I send?

as seen on Stack Overflow - Search for 'Stack Overflow'
Based on Please explain JSONP, I understand that JSONP can be used to get around the same-origin policy. But in order to do that, the page must use a <script> tag. I know that pages can dynamically emit new script tags, such as with: <script type="text/javascript" language='javascript'> … >>> More
is JsonP working with Opera, Chrome & Safari ?

as seen on Stack Overflow - Search for 'Stack Overflow'
Hi, On a web site that I am building , when you log in (because the database is on an other server), I use json padding to check if the user as the right credentials. It's working flawlessly (ie7,ie8 & FF), until I tried it on chrome, safari & opera where it's a complete disaster. … >>> More
Creating a JSONP Formatter for ASP.NET Web API

as seen on West-Wind - Search for 'West-Wind'
Out of the box ASP.NET WebAPI does not include a JSONP formatter, but it's actually very easy to create a custom formatter that implements this functionality. JSONP is one way to allow Browser based JavaScript client applications to bypass cross-site scripting limitations and serve data from the non-current… >>> More

Related posts about xss-prevention

XSS prevention in PHP

as seen on Stack Overflow - Search for 'Stack Overflow'
I need to prevent XSS attacks in PHP code, is there nay good and easy library for this? >>> More
XSS prevention in Java

as seen on Stack Overflow - Search for 'Stack Overflow'
How can I prevent XSS attacks in Java? Are there any good libraries for that? >>> More
Is there Java counterpart for Aspnet 4's <%: %> XSS prevention?

as seen on Stack Overflow - Search for 'Stack Overflow'
I'm developer moving from C# to Java. Heard about new ASP net feature. <%: %. It renders object with html encoding. Only these impolementing IHtmlString interface are not encoded (to prevent double encoding). See more in http://weblogs.asp.net/scottgu/archive/2010/04/06/new-lt-gt-syntax-for-html-encoding-output-in-asp-net-4-and-asp-net-mvc-2… >>> More
Why isn't ValidateRequest="true" enough for XSS prevention?

as seen on Stack Overflow - Search for 'Stack Overflow'
In the notes for Step 1 in the "How To: Prevent Cross-Site Scripting in ASP.NET" it is stated that you should "not rely on ASP.NET request validation. Treat it as an extra precautionary measure in addition to your own input validation." Why isn't it enough? >>> More
PHP XSS Prevention WhiteListing

as seen on Stack Overflow - Search for 'Stack Overflow'
My site utilizes a WYSIWYG editor for users to update their accounts,enter comments, and send private messages. The editor (CKEditor) is great for only allowing users to enter valid input, but I worry about injection through TamperData or other means. How can I control this on the server side… >>> More