enforece usage of require.define callback parameter for packages

src/node/utils/caching_middleware.js

@@ -21,6 +21,8 @@ const path = require('path');
 const zlib = require('zlib');
 const settings = require('./Settings');
 const existsSync = require('./path_exists');
+const queryString = require('querystring');
+const url = require('url');
 
 /*
  * The crypto module can be absent on reduced node installations.
@@ -89,9 +91,16 @@ CachingMiddleware.prototype = new function () {
     const old_res = {};
 
     const supportsGzip =
-        (req.get('Accept-Encoding') || '').indexOf('gzip') != -1;
+        (req.get('Accept-Encoding') || '').indexOf('gzip') !== -1;
+
+    const URL = url.parse(req.url);
+    const path = URL.pathname;
+    const query = queryString.parse(URL.query);
+
+    if (query.callback !== 'require.define') {
+      return res.sendStatus(400);
+    }
 
-    const path = require('url').parse(req.url).pathname;
     const cacheKey = generateCacheKey(path);
 
     fs.stat(`${CACHE_DIR}minified_${cacheKey}`, (error, stats) => {

tests/backend/specs/caching_middleware.js

@@ -139,17 +139,16 @@ describe(__filename, function () {
           });
     });
 
-    // TODO should probably be 404
-    it('should 502 for unknown and known resources without jsonp callback', async function() {
+    it('should return 400 for unknown and known resources without jsonp callback', async function() {
       const missingCallbackUnknownFile = '/javascripts/lib/ep_etherpad-lite/static/js/ace2_inner2.js';
       const missingCallbackKnownFile = '/javascripts/lib/ep_etherpad-lite/static/js/ace2_inner.js';
       await agent.get(missingCallbackUnknownFile)
           .then((res) => {
-          assert.equal(res.statusCode, 502);
+          assert.equal(res.statusCode, 400);
           });
       await agent.get(missingCallbackKnownFile)
           .then((res) => {
-          assert.equal(res.statusCode, 502);
+          assert.equal(res.statusCode, 400);
           });
     });
 
@@ -272,17 +271,16 @@ describe(__filename, function () {
           });
     });
 
-    // TODO should probably be 404
-    it('should 502 for unknown and known resources without jsonp callback', async function() {
+    it('should return 400 for unknown and known resources without jsonp callback', async function() {
       const missingCallbackUnknownFile = '/javascripts/lib/ep_etherpad-lite/static/js/ace2_inner2.js';
       const missingCallbackKnownFile = '/javascripts/lib/ep_etherpad-lite/static/js/ace2_inner.js';
       await agent.get(missingCallbackUnknownFile)
           .then((res) => {
-          assert.equal(res.statusCode, 502);
+          assert.equal(res.statusCode, 400);
           });
       await agent.get(missingCallbackKnownFile)
           .then((res) => {
-          assert.equal(res.statusCode, 502);
+          assert.equal(res.statusCode, 400);
           });
     });