Spring/spring-framework
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Change default JSON prefix from "{} && " to ")]}', "

Browse Source 
Issue: SPR-13078
This commit is contained in:
Sebastien Deleuze
2015-06-16 11:30:07 +02:00
parent a08c9f3137
commit 8187833502
6 changed files with 26 additions and 22 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
spring-web/src/main/java/org/springframework/http/converter/json/GsonHttpMessageConverter.java
View File

@@ -101,17 +101,16 @@ public class GsonHttpMessageConverter extends AbstractHttpMessageConverter<Objec
}
/**
* Indicate whether the JSON output by this view should be prefixed with "{} &&".
* Indicate whether the JSON output by this view should be prefixed with ")]}', ".
* Default is {@code false}.
* <p>Prefixing the JSON string in this manner is used to help prevent JSON
* Hijacking. The prefix renders the string syntactically invalid as a script
* so that it cannot be hijacked. This prefix does not affect the evaluation
* of JSON, but if JSON validation is performed on the string, the prefix
* would need to be ignored.
* so that it cannot be hijacked.
* This prefix should be stripped before parsing the string as JSON.
* @see #setJsonPrefix
*/
public void setPrefixJson(boolean prefixJson) {
this.jsonPrefix = (prefixJson ? "{} && " : null);
this.jsonPrefix = (prefixJson ? ")]}', " : null);
}

7
spring-web/src/main/java/org/springframework/http/converter/json/MappingJackson2HttpMessageConverter.java
View File

@@ -76,15 +76,14 @@ public class MappingJackson2HttpMessageConverter extends AbstractJackson2HttpMes
}
/**
* Indicate whether the JSON output by this view should be prefixed with "{} &&". Default is false.
* Indicate whether the JSON output by this view should be prefixed with ")]}', ". Default is false.
* <p>Prefixing the JSON string in this manner is used to help prevent JSON Hijacking.
* The prefix renders the string syntactically invalid as a script so that it cannot be hijacked.
* This prefix does not affect the evaluation of JSON, but if JSON validation is performed on the
* string, the prefix would need to be ignored.
* This prefix should be stripped before parsing the string as JSON.
* @see #setJsonPrefix
*/
public void setPrefixJson(boolean prefixJson) {
this.jsonPrefix = (prefixJson ? "{} && " : null);
this.jsonPrefix = (prefixJson ? ")]}', " : null);
}