Function jsonp

packages/jsonp/src/index.ts:42–73

(req: Request, res: Response)

 * @param app App
 */
export const jsonp = (req: Request, res: Response) => (obj: unknown, opts: JSONPOptions = {}) => {
  const val = obj

  const { escape, replacer, spaces, callbackName = 'callback' } = opts

  let body = stringify(val, replacer, spaces, escape)

  let callback = req.query[callbackName]

  if (!res.get('Content-Type')) {
    res.set('X-Content-Type-Options', 'nosniff')
    res.set('Content-Type', 'application/json')
  }

  // jsonp
  if (typeof callback === 'string' && callback.length !== 0) {
    res.set('X-Content-Type-Options', 'nosniff')
    res.set('Content-Type', 'text/javascript')

    // restrict callback charset
    callback = callback.replace(/[^[\]\w$.]/g, '')

    // replace chars not allowed in JavaScript that are in JSON
    body = body.replace(/\u2028/g, '\\u2028').replace(/\u2029/g, '\\u2029')

    // the /**/ is a specific security mitigation for "Rosetta Flash JSONP abuse"
    // the typeof check is just to reduce client error noise
    body = `/**/ typeof ${callback} === 'function' && ${callback}(${body});`
  }

  return res.send(body)
}