Spring/spring-framework
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Deprecate JSONP and disable it by default in Jackson view

Browse Source 
Issue: SPR-16798
This commit is contained in:
Sebastien Deleuze
2018-06-08 12:29:48 +02:00
parent 75a6f3b2b6
commit 874859493b
11 changed files with 61 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
spring-webmvc/src/main/java/org/springframework/web/servlet/mvc/method/annotation/AbstractJsonpResponseBodyAdvice.java
View File

@@ -1,5 +1,5 @@
/*
* Copyright 2002-2015 the original author or authors.
* Copyright 2002-2018 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@@ -45,7 +45,10 @@ import org.springframework.util.ObjectUtils;
*
* @author Rossen Stoyanchev
* @since 4.1
* @deprecated Will be removed as of Spring Framework 5.1, use
* <a href="https://docs.spring.io/spring/docs/4.3.x/spring-framework-reference/html/cors.html">CORS</a> instead.
*/
@Deprecated
public abstract class AbstractJsonpResponseBodyAdvice extends AbstractMappingJacksonResponseBodyAdvice {
/**

15
spring-webmvc/src/main/java/org/springframework/web/servlet/view/json/MappingJackson2JsonView.java
View File

@@ -1,5 +1,5 @@
/*
* Copyright 2002-2015 the original author or authors.
* Copyright 2002-2018 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@@ -17,7 +17,6 @@
package org.springframework.web.servlet.view.json;
import java.io.IOException;
import java.util.Arrays;
import java.util.Collections;
import java.util.HashMap;
import java.util.LinkedHashSet;
@@ -58,6 +57,7 @@ import org.springframework.web.servlet.View;
* @author Sebastien Deleuze
* @since 3.1.2
*/
@SuppressWarnings("deprecation")
public class MappingJackson2JsonView extends AbstractJackson2View {
/**
@@ -68,7 +68,10 @@ public class MappingJackson2JsonView extends AbstractJackson2View {
/**
* Default content type for JSONP: "application/javascript".
* @deprecated Will be removed as of Spring Framework 5.1, use
* <a href="https://docs.spring.io/spring/docs/4.3.x/spring-framework-reference/html/cors.html">CORS</a> instead.
*/
@Deprecated
public static final String DEFAULT_JSONP_CONTENT_TYPE = "application/javascript";
/**
@@ -83,7 +86,7 @@ public class MappingJackson2JsonView extends AbstractJackson2View {
private boolean extractValueFromSingleKeyModel = false;
private Set<String> jsonpParameterNames = new LinkedHashSet<String>(Arrays.asList("jsonp", "callback"));
private Set<String> jsonpParameterNames = new LinkedHashSet<String>();
/**
@@ -168,7 +171,10 @@ public class MappingJackson2JsonView extends AbstractJackson2View {
* <p>The parameter names configured by default are "jsonp" and "callback".
* @since 4.1
* @see <a href="http://en.wikipedia.org/wiki/JSONP">JSONP Wikipedia article</a>
* @deprecated Will be removed as of Spring Framework 5.1, use
* <a href="https://docs.spring.io/spring/docs/4.3.x/spring-framework-reference/html/cors.html">CORS</a> instead.
*/
@Deprecated
public void setJsonpParameterNames(Set<String> jsonpParameterNames) {
this.jsonpParameterNames = jsonpParameterNames;
}
@@ -198,7 +204,10 @@ public class MappingJackson2JsonView extends AbstractJackson2View {
* Invalid parameter values are ignored.
* @param value the query param value, never {@code null}
* @since 4.1.8
* @deprecated Will be removed as of Spring Framework 5.1, use
* <a href="https://docs.spring.io/spring/docs/4.3.x/spring-framework-reference/html/cors.html">CORS</a> instead.
*/
@Deprecated
protected boolean isValidJsonpQueryParam(String value) {
return CALLBACK_PARAM_PATTERN.matcher(value).matches();
}

14
spring-webmvc/src/test/java/org/springframework/web/servlet/view/json/MappingJackson2JsonViewTests.java
View File

@@ -1,5 +1,5 @@
/*
* Copyright 2002-2015 the original author or authors.
* Copyright 2002-2018 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@@ -17,9 +17,11 @@
package org.springframework.web.servlet.view.json;
import java.io.IOException;
import java.util.Arrays;
import java.util.Date;
import java.util.HashMap;
import java.util.HashSet;
import java.util.LinkedHashSet;
import java.util.Map;
import java.util.Set;
@@ -324,11 +326,19 @@ public class MappingJackson2JsonViewTests {
@Test
public void renderWithJsonp() throws Exception {
testJsonp("jsonp", "callback", false);
testJsonp("jsonp", "_callback", false);
testJsonp("jsonp", "_Call.bAcK", false);
testJsonp("jsonp", "0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ_.", false);
testJsonp("jsonp", "<script>", false);
testJsonp("jsonp", "!foo!bar", false);
this.view.setJsonpParameterNames(new LinkedHashSet<String>(Arrays.asList("jsonp")));
testJsonp("jsonp", "callback", true);
testJsonp("jsonp", "_callback", true);
testJsonp("jsonp", "_Call.bAcK", true);
testJsonp("jsonp", "0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ_.", true);
testJsonp("jsonp", "<script>", false);
testJsonp("jsonp", "!foo!bar", false);
}