spray/spray — pull request #392 by andrebeat (2013-07-24 01:23:23+00:00)
Title: Validate JSONP callback parameter

Fixes #308.

The callback parameter is validated to only include alphanumeric, underscore (_), dollar ($) and dot (.) characters. Otherwise the request is rejected with MalformedQueryParamRejection.

The regex can definitely be improved since it still allows invalid javascript identifiers and rejects valid ones (e.g. foo[0]). Still, it seems to prevent the XSS exploits while allowing the most common usage. Let me know you what you think.

The commit messages do not follow the guidelines, but I'll squash the commits after someone reviews this.