TemplateEngineJsonP implements TemplateEngine { public static boolean isThisASecureCallbackName(String callback) { return !Strings.isNullOrEmpty(callback) && !callback.contains("..") && CALLBACK_SECURITY_VALIDATION_REGEXP.matcher(callback).matches(); } @Inject  TemplateEngineJsonP(ObjectMapper objectMapper, NinjaProperties properties); @Override void invoke(Context context, Result result); @Override String getContentType(); @Override String getSuffixOfTemplatingEngine(); static boolean isThisASecureCallbackName(String callback);  }
@Test public void testIsThisASecureCallbackName() { assertTrue("simple function", TemplateEngineJsonP.isThisASecureCallbackName("onResponse")); assertTrue("object function", TemplateEngineJsonP.isThisASecureCallbackName("MyPath.path")); assertTrue("object function", TemplateEngineJsonP.isThisASecureCallbackName("MyApp.Path.myCallback123")); assertTrue("object function, path with numbers", TemplateEngineJsonP.isThisASecureCallbackName("MyApp123.Path789.myCallback123")); assertTrue("complex path", TemplateEngineJsonP.isThisASecureCallbackName("Ext.data.JsonP.callback4")); assertTrue("complex path, $ in identity.", TemplateEngineJsonP.isThisASecureCallbackName("$42.ajaxHandler")); assertFalse("wrong first character", TemplateEngineJsonP.isThisASecureCallbackName("42$.q")); assertFalse("period in the front, simple", TemplateEngineJsonP.isThisASecureCallbackName(".onResponse")); assertFalse("period in the end, simple", TemplateEngineJsonP.isThisASecureCallbackName("onResponse.")); assertFalse("period in the front, object function", TemplateEngineJsonP.isThisASecureCallbackName(".MyPath.path")); assertFalse("period in the end, complex path", TemplateEngineJsonP.isThisASecureCallbackName("MyPath.path.path2.")); assertFalse("two subsequent periods", TemplateEngineJsonP.isThisASecureCallbackName("MyPath..path.path2")); assertFalse("function call", TemplateEngineJsonP.isThisASecureCallbackName("alert(document.cookie)")); assertFalse("simple array", TemplateEngineJsonP.isThisASecureCallbackName("somearray[12345]")); assertFalse("unicode characters", TemplateEngineJsonP.isThisASecureCallbackName("\\u0062oo")); assertFalse("unicode characters", TemplateEngineJsonP.isThisASecureCallbackName("\\u0020")); }