import re

from .view_error import *

class JSONPMiddleware(object):
    def process_response(self, request, response):
        # If the response is a redirect, the callback will be dealt
        # on the next request:
        if response.status_code == 302:
            return response
        else:
            if request.GET.get('callback') and re.match('[a-zA-Z0-9_$.]+$', request.GET.get('callback')):
                response.content = request.GET.get('callback').encode('utf-8') + b'(' + response.content + b')'
                response.status_code = 200 # Must return OK for JSONP to be processed
            return response


import re

from .view_error import *

class JSONPMiddleware(object):
    def process_response(self, request, response):
        # If the response is a redirect, the callback will be dealt
        # on the next request:
        if response.status_code == 302:
            return response
        else:
            cb = request.GET.get('callback')
            if cb and re.match('[a-zA-Z0-9_$.]+$', cb):
                cb = cb.encode('utf-8')
                response.content = b'typeof ' + cb + b" === 'function' && " + cb + b'(' + response.content + b')'
                response.status_code = 200 # Must return OK for JSONP to be processed
            return response


Include typeof check in JSONP callback response.
Include typeof check in JSONP callback response.

This is more robust, and helps against attacks such as Rosetta Flash:
https://miki.it/blog/2014/7/8/abusing-jsonp-with-rosetta-flash/

  import re
  
  from .view_error import *
  
  class JSONPMiddleware(object):
      def process_response(self, request, response):
          # If the response is a redirect, the callback will be dealt
          # on the next request:
          if response.status_code == 302:
              return response
          else:
-             if request.GET.get('callback') and re.match('[a-zA-Z0-9_$.]+$', request.GET.get('callback')):
-                 response.content = request.GET.get('callback').encode('utf-8') + b'(' + response.content + b')'
+             cb = request.GET.get('callback')
+             if cb and re.match('[a-zA-Z0-9_$.]+$', cb):
+                 cb = cb.encode('utf-8')
+                 response.content = b'typeof ' + cb + b" === 'function' && " + cb + b'(' + response.content + b')'
                  response.status_code = 200 # Must return OK for JSONP to be processed
              return response
  
  
Include typeof check in JSONP callback response.
## Code Before:
import re

from .view_error import *

class JSONPMiddleware(object):
    def process_response(self, request, response):
        # If the response is a redirect, the callback will be dealt
        # on the next request:
        if response.status_code == 302:
            return response
        else:
            if request.GET.get('callback') and re.match('[a-zA-Z0-9_$.]+$', request.GET.get('callback')):
                response.content = request.GET.get('callback').encode('utf-8') + b'(' + response.content + b')'
                response.status_code = 200 # Must return OK for JSONP to be processed
            return response


## Instruction:
Include typeof check in JSONP callback response.
## Code After:
import re

from .view_error import *

class JSONPMiddleware(object):
    def process_response(self, request, response):
        # If the response is a redirect, the callback will be dealt
        # on the next request:
        if response.status_code == 302:
            return response
        else:
            cb = request.GET.get('callback')
            if cb and re.match('[a-zA-Z0-9_$.]+$', cb):
                cb = cb.encode('utf-8')
                response.content = b'typeof ' + cb + b" === 'function' && " + cb + b'(' + response.content + b')'
                response.status_code = 200 # Must return OK for JSONP to be processed
            return response

