mde/geddy — pull request #305 by kr1zmo (2013-02-03 07:52:51+00:00)
Title: JSONP: Added regex filter to ensure callback is valid JavaScript function.

This will overcome an XSS vulnerability that allows any string data
inside the callback parameter - as long as the data is a string. This
filters the callback parmeter to verify it only contains alpha (also
capital), numeric characters, underscore, and dollar sign ($), also
ensuring the begining is not a number.

case: documented on [stackoverflow](http://stackoverflow.com/questions/8750469/apparent-jsonp-xss-vulnerability)