Revert "fix: repair the impact of JSONP on normal requests(#2692) (#2699

)" (#2700) This reverts commit a2d7ad7.
midwayjs · Feb 2, 2023 · b635767 · b635767
1 parent a2d7ad7
commit b635767
Show file tree

Hide file tree

Showing 3 changed files with 24 additions and 35 deletions.
diff --git a/packages/cross-domain/src/jsonp.ts b/packages/cross-domain/src/jsonp.ts
@@ -12,31 +12,28 @@ export class JSONPService {
   res;
 
   jsonp(body: any, config?: JSONPOptions) {
-    const { callback, limit } = Object.assign({}, this.jsonpConfig, config);
-    const name = this.ctx.query[callback] || this.ctx.query['callback'];
-    if (name) {
-      this.ctx.type = 'js';
-      // https://developer.mozilla.org/zh-CN/docs/Web/HTTP/Headers/X-Content-Type-Options
-      if (this.ctx.set) {
-        this.ctx.set('x-content-type-options', 'nosniff');
-      } else if (this.res.set) {
-        this.res.set('x-content-type-options', 'nosniff');
-      }
+    this.ctx.type = 'js';
+    // https://developer.mozilla.org/zh-CN/docs/Web/HTTP/Headers/X-Content-Type-Options
+    if (this.ctx.set) {
+      this.ctx.set('x-content-type-options', 'nosniff');
+    } else if (this.res.set) {
+      this.res.set('x-content-type-options', 'nosniff');
+    }
 
-      // Only allow "[","]","a-zA-Z0123456789_", "$" and "." characters.
-      let cb = (this.ctx.query[callback] || 'callback').replace(
-        /[^[\]\w$.]+/g,
-        ''
-      );
+    const { callback, limit } = Object.assign({}, this.jsonpConfig, config);
 
-      if (cb.length > limit) {
-        cb = cb.substring(0, limit);
-      }
+    // Only allow "[","]","a-zA-Z0123456789_", "$" and "." characters.
+    let cb = (this.ctx.query[callback] || 'callback').replace(
+      /[^[\]\w$.]+/g,
+      ''
+    );
 
-      const str = JSON.stringify(body === undefined ? null : body);
-      // protect from jsonp xss
-      return `/**/ typeof ${cb} === 'function' && ${cb}(${str});`;
+    if (cb.length > limit) {
+      cb = cb.substring(0, limit);
     }
-    return body;
+
+    const str = JSON.stringify(body === undefined ? null : body);
+    // protect from jsonp xss
+    return `/**/ typeof ${cb} === 'function' && ${cb}(${str});`;
   }
 }
diff --git a/packages/cross-domain/test/express.test.ts b/packages/cross-domain/test/express.test.ts
@@ -42,7 +42,7 @@ describe('test/express.test.ts', function () {
       .expect(res => {
         assert(!res.headers['access-control-allow-origin']);
       })
-      .expect(200);
+      .expect(200)
   });
 
   it('jsonp callback', async () => {
@@ -51,11 +51,6 @@ describe('test/express.test.ts', function () {
       .post('/jsonp?callback=fn')
       .expect(200)
       .expect('x-content-type-options', 'nosniff')
-      .expect(`/**/ typeof callback === 'function' && callback({"test":123});`);
-  });
-
-  it('jsonp callback ignore', async () => {
-    const request = await createHttpRequest(app);
-    await request.post('/jsonp').expect(200).expect({ test: 123 });
+      .expect(`/**/ typeof callback === 'function' && callback({"test":123});`)
   });
 });
diff --git a/packages/cross-domain/test/koa.test.ts b/packages/cross-domain/test/koa.test.ts
@@ -8,7 +8,7 @@ describe('test/koa.test.ts', function () {
     try {
       app = await createApp(appDir);
     } catch (e) {
-      console.log('e', e);
+      console.log("e", e);
     }
   });
 
@@ -49,17 +49,14 @@ describe('test/koa.test.ts', function () {
       .expect(200);
   });
 
+
   it('jsonp callback', async () => {
     const request = await createHttpRequest(app);
     await request
       .post('/jsonp?callback=fn')
       .expect(200)
       .expect('x-content-type-options', 'nosniff')
-      .expect(`/**/ typeof callback === 'function' && callback({"test":123});`);
-  });
+      .expect(`/**/ typeof callback === 'function' && callback({"test":123});`)
 
-  it('jsonp callback ignore', async () => {
-    const request = await createHttpRequest(app);
-    await request.post('/jsonp').expect(200).expect({ test: 123 });
   });
 });