Merge pull request #1553 from NatLibFi/fix-jsonp-callback-filter

Harden JSONP callback filter
NatLibFi · Nov 22, 2023 · 88c2c78 · 88c2c78
2 parents e9e5447 + 33ef7e8
commit 88c2c78
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/controller/RestController.php b/controller/RestController.php
@@ -25,7 +25,7 @@ private function returnJson($data)
         // wrap with JSONP callback if requested
         if (filter_input(INPUT_GET, 'callback', FILTER_SANITIZE_FULL_SPECIAL_CHARS)) {
             header("Content-type: application/javascript; charset=utf-8");
-            echo filter_input(INPUT_GET, 'callback', FILTER_UNSAFE_RAW) . "(" . json_encode($data) . ");";
+            echo filter_input(INPUT_GET, 'callback', FILTER_SANITIZE_FULL_SPECIAL_CHARS) . "(" . json_encode($data) . ");";
             return;
         }