Prevent swf attack in jsonp responses.

Author: [email protected]

ReleaseNotes.txt

@@ -1,3 +1,7 @@
+Version 1.1.2
+-----------------------------------------
+- Fix security threat of swf injection in jsonp.
+
 Version 1.1.1
 -----------------------------------------   
 - Move from google-collect-1.0 to guava-r07.

pom.xml

@@ -10,7 +10,7 @@
   <groupId>com.google.visualization</groupId>
   <artifactId>visualization-datasource</artifactId>
   <name>Google Visualization Data Source Library</name>
-  <version>1.1.1</version>
+  <version>1.1.2</version>
   <description>This library makes it easy to implement a Visualization data source so that you can
     easily chart or visualize your data from any of your data stores.
     The library implements the Google Visualization API wire protocol and query language.

src/main/java/com/google/visualization/datasource/DataSourceHelper.java

@@ -285,7 +285,9 @@ public static String generateResponse(DataTable dataTable, DataSourceRequest dat
         response = HtmlRenderer.renderDataTable(dataTable, dataSourceRequest.getUserLocale());
         break;
       case JSONP:
-        response = JsonRenderer.renderJsonResponse(
+        // Appending a comment to the response to prevent the first characters to be the
+        // response handler which is not controlled by the server.
+        response = "// Data table response\n" + JsonRenderer.renderJsonResponse(
             dataSourceRequest.getDataSourceParameters(), responseStatus, dataTable);
         break;
       case JSON:

src/main/java/com/google/visualization/datasource/base/DataSourceParameters.java

@@ -223,7 +223,8 @@ public void setOutputType(OutputType outputType) {
    * @return The response handler.
    */
   public String getResponseHandler() {
-    return responseHandler;
+    // Remove characters that can be a threat when injecting scripts.
+    return responseHandler.replaceAll("[^a-zA-Z0-9_\\.]", "");
   }
 
   /**

src/test/java/com/google/visualization/datasource/DataSourceHelperTest.java

@@ -226,7 +226,7 @@ public void testGenerateResponse() throws DataSourceException {
         new DataSourceParameters("out:jsonp"),
         ULocale.UK);
     assertEquals(
-        "google.visualization.Query.setResponse("
+        "// Data table response\ngoogle.visualization.Query.setResponse("
         + "{\"version\":\"0.6\",\"status\":\"ok\",\"sig\":\"1548939605\","
         + "\"table\":{\"cols\":[{\"id\":\"col1\",\"label\":\"column1\","
         + "\"type\":\"number\",\"pattern\":\"\"},"