Revert "fix: repair the impact of JSONP on normal requests(#2692) (#2699

)" (#2700) This reverts commit a2d7ad7.
midwayjs · Feb 2, 2023 · b635767 · b635767
1 parent a2d7ad7
commit b635767
Show file tree

Hide file tree

Showing 3 changed files with 24 additions and 35 deletions.
diff --git a/packages/cross-domain/src/jsonp.ts b/packages/cross-domain/src/jsonp.ts
@@ -12,31 +12,28 @@ export class JSONPService {
  res;
 
  jsonp(body: any, config?: JSONPOptions) {
- const { callback, limit } = Object.assign({}, this.jsonpConfig, config);
- const name = this.ctx.query[callback] || this.ctx.query['callback'];
- if (name) {
- this.ctx.type = 'js';
- // https://developer.mozilla.org/zh-CN/docs/Web/HTTP/Headers/X-Content-Type-Options
- if (this.ctx.set) {
- this.ctx.set('x-content-type-options', 'nosniff');
- } else if (this.res.set) {
- this.res.set('x-content-type-options', 'nosniff');
- }
+ this.ctx.type = 'js';
+ // https://developer.mozilla.org/zh-CN/docs/Web/HTTP/Headers/X-Content-Type-Options
+ if (this.ctx.set) {
+ this.ctx.set('x-content-type-options', 'nosniff');
+ } else if (this.res.set) {
+ this.res.set('x-content-type-options', 'nosniff');
+ }
 
- // Only allow "[","]","a-zA-Z0123456789_", "$" and "." characters.
- let cb = (this.ctx.query[callback] || 'callback').replace(
- /[^[\]\w$.]+/g,
- ''
- );
+ const { callback, limit } = Object.assign({}, this.jsonpConfig, config);
 
- if (cb.length > limit) {
- cb = cb.substring(0, limit);
- }
+ // Only allow "[","]","a-zA-Z0123456789_", "$" and "." characters.
+ let cb = (this.ctx.query[callback] || 'callback').replace(
+ /[^[\]\w$.]+/g,
+ ''
+ );
 
- const str = JSON.stringify(body === undefined ? null : body);
- // protect from jsonp xss
- return `/**/ typeof ${cb} === 'function' && ${cb}(${str});`;
+ if (cb.length > limit) {
+ cb = cb.substring(0, limit);
  }
- return body;
+
+ const str = JSON.stringify(body === undefined ? null : body);
+ // protect from jsonp xss
+ return `/**/ typeof ${cb} === 'function' && ${cb}(${str});`;
  }
 }
diff --git a/packages/cross-domain/test/express.test.ts b/packages/cross-domain/test/express.test.ts
@@ -42,7 +42,7 @@ describe('test/express.test.ts', function () {
  .expect(res => {
  assert(!res.headers['access-control-allow-origin']);
  })
- .expect(200);
+ .expect(200)
  });
 
  it('jsonp callback', async () => {
@@ -51,11 +51,6 @@ describe('test/express.test.ts', function () {
  .post('/jsonp?callback=fn')
  .expect(200)
  .expect('x-content-type-options', 'nosniff')
- .expect(`/**/ typeof callback === 'function' && callback({"test":123});`);
- });
-
- it('jsonp callback ignore', async () => {
- const request = await createHttpRequest(app);
- await request.post('/jsonp').expect(200).expect({ test: 123 });
+ .expect(`/**/ typeof callback === 'function' && callback({"test":123});`)
  });
 });
diff --git a/packages/cross-domain/test/koa.test.ts b/packages/cross-domain/test/koa.test.ts
@@ -8,7 +8,7 @@ describe('test/koa.test.ts', function () {
  try {
  app = await createApp(appDir);
  } catch (e) {
- console.log('e', e);
+ console.log("e", e);
  }
  });
 
@@ -49,17 +49,14 @@ describe('test/koa.test.ts', function () {
  .expect(200);
  });
 
+
  it('jsonp callback', async () => {
  const request = await createHttpRequest(app);
  await request
  .post('/jsonp?callback=fn')
  .expect(200)
  .expect('x-content-type-options', 'nosniff')
- .expect(`/**/ typeof callback === 'function' && callback({"test":123});`);
- });
+ .expect(`/**/ typeof callback === 'function' && callback({"test":123});`)
 
- it('jsonp callback ignore', async () => {
- const request = await createHttpRequest(app);
- await request.post('/jsonp').expect(200).expect({ test: 123 });
  });
 });