From dd7894d3c9389a000d11d3a89962d9fcc9c6c44b Mon Sep 17 00:00:00 2001
From: Peter 'Pita' Martischka <petermartischka@gmail.com>
Date: Fri, 23 Mar 2018 11:17:39 +0000
Subject: [PATCH] Added a jsonp var checker

---
 src/node/hooks/express/apicalls.js         | 10 +--
 src/node/hooks/express/isValidJSONPName.js | 83 ++++++++++++++++++++++
 2 files changed, 88 insertions(+), 5 deletions(-)
 create mode 100644 src/node/hooks/express/isValidJSONPName.js

diff --git a/src/node/hooks/express/apicalls.js b/src/node/hooks/express/apicalls.js
index 009a93d72..e07bbb0be 100644
--- a/src/node/hooks/express/apicalls.js
+++ b/src/node/hooks/express/apicalls.js
@@ -3,7 +3,7 @@ var apiLogger = log4js.getLogger("API");
 var clientLogger = log4js.getLogger("client");
 var formidable = require('formidable');
 var apiHandler = require('../../handler/APIHandler');
-var isVarName = require('is-var-name');
+var isValidJSONPName = require('./isValidJsonPName');
 
 //This is for making an api call, collecting all post information and passing it to the apiHandler
 var apiCaller = function(req, res, fields) {
@@ -19,7 +19,7 @@ var apiCaller = function(req, res, fields) {
     apiLogger.info("RESPONSE, " + req.params.func + ", " + response);
 
     //is this a jsonp call, if yes, add the function call
-    if(req.query.jsonp && isVarName(req.query.jsonp))
+    if(req.query.jsonp && isValidJSONPName.check(req.query.jsonp))
       response = req.query.jsonp + "(" + response + ")";
 
     res._____send(response);
@@ -46,7 +46,7 @@ exports.expressCreateServer = function (hook_name, args, cb) {
 
   //The Etherpad client side sends information about how a disconnect happened
   args.app.post('/ep/pad/connection-diagnostic-info', function(req, res) {
-    new formidable.IncomingForm().parse(req, function(err, fields, files) { 
+    new formidable.IncomingForm().parse(req, function(err, fields, files) {
       clientLogger.info("DIAGNOSTIC-INFO: " + fields.diagnosticInfo);
       res.end("OK");
     });
@@ -54,7 +54,7 @@ exports.expressCreateServer = function (hook_name, args, cb) {
 
   //The Etherpad client side sends information about client side javscript errors
   args.app.post('/jserror', function(req, res) {
-    new formidable.IncomingForm().parse(req, function(err, fields, files) { 
+    new formidable.IncomingForm().parse(req, function(err, fields, files) {
       try {
         var data = JSON.parse(fields.errorInfo)
       }catch(e){
@@ -64,7 +64,7 @@ exports.expressCreateServer = function (hook_name, args, cb) {
       res.end("OK");
     });
   });
-  
+
   //Provide a possibility to query the latest available API version
   args.app.get('/api', function (req, res) {
      res.json({"currentVersion" : apiHandler.latestApiVersion});
diff --git a/src/node/hooks/express/isValidJSONPName.js b/src/node/hooks/express/isValidJSONPName.js
new file mode 100644
index 000000000..47755ef86
--- /dev/null
+++ b/src/node/hooks/express/isValidJSONPName.js
@@ -0,0 +1,83 @@
+const RESERVED_WORDS = [
+  'abstract',
+  'arguments',
+  'await',
+  'boolean',
+  'break',
+  'byte',
+  'case',
+  'catch',
+  'char',
+  'class',
+  'const',
+  'continue',
+  'debugger',
+  'default',
+  'delete',
+  'do',
+  'double',
+  'else',
+  'enum',
+  'eval',
+  'export',
+  'extends',
+  'false',
+  'final',
+  'finally',
+  'float',
+  'for',
+  'function',
+  'goto',
+  'if',
+  'implements',
+  'import',
+  'in',
+  'instanceof',
+  'int',
+  'interface',
+  'let',
+  'long',
+  'native',
+  'new',
+  'null',
+  'package',
+  'private',
+  'protected',
+  'public',
+  'return',
+  'short',
+  'static',
+  'super',
+  'switch',
+  'synchronized',
+  'this',
+  'throw',
+  'throws',
+  'transient',
+  'true',
+  'try',
+  'typeof',
+  'var',
+  'void',
+  'volatile',
+  'while',
+  'with',
+  'yield'
+];
+
+const regex = /^[a-zA-Z_$][0-9a-zA-Z_$]*(?:\[(?:".+"|\'.+\'|\d+)\])*?$/;
+
+module.exports.check = function(inputStr) {
+  var isValid = true;
+  inputStr.split(".").forEach(function(part) {
+    if (!regex.test(part)) {
+      isValid = false;
+    }
+
+    if (RESERVED_WORDS.indexOf(part) !== -1) {
+      isValid = false;
+    }
+  });
+
+  return isValid;
+}