Fix edge cases

willdurand · Oct 21, 2013 · 76e13fc · 76e13fc
1 parent a64e2d3
commit 76e13fc
Show file tree

Hide file tree

Showing 2 changed files with 9 additions and 2 deletions.
diff --git a/src/JsonpCallbackValidator.php b/src/JsonpCallbackValidator.php
@@ -8,6 +8,8 @@
  */
 class JsonpCallbackValidator
 {
+    private $regexp = '/^[a-zA-Z_$][0-9a-zA-Z_$]*(?:\[(?:"(?:\\\.|[^"\\\])*"|\'(?:\\\.|[^\'\\\])*\'|\d+)\])*?$/';
+
     private $reservedKeywords = array(
         'break',
         'do',
@@ -63,7 +65,7 @@ class JsonpCallbackValidator
     public function validate($callback)
     {
         foreach (explode('.', $callback) as $identifier) {
-            if (!preg_match('/^[a-zA-Z_$][0-9a-zA-Z_$]*(?:\[(?:".+"|\'.+\'|\d+)\])*?$/', $identifier)) {
+            if (!preg_match($this->regexp, $identifier)) {
                 return false;
             }
 

diff --git a/tests/JsonpCallbackValidatorTest.php b/tests/JsonpCallbackValidatorTest.php
@@ -37,7 +37,7 @@ public static function dataProviderForTestValidate()
             array('array_of_functions["key"]',    self::IS_VALID),
             array('_function',                    self::IS_VALID),
             array('petersCallback1412331422[12]', self::IS_VALID),
-            array('(function xss(x){evil()})',    self::IS_INVALID),
+            array('(function xss(x) {evil()})',    self::IS_INVALID),
             array('',                             self::IS_INVALID),
             array('alert()',                      self::IS_INVALID),
             array('test()',                       self::IS_INVALID),
@@ -54,6 +54,9 @@ public static function dataProviderForTestValidate()
             array('array_of_functions["k"ey"]',   self::IS_INVALID),
             array('array_of_functions["k\"ey"]',  self::IS_VALID),
             array('array_of_functions["k""y"]',   self::IS_INVALID),
+            array('array_of_functions["""y"]',    self::IS_INVALID),
+            array('array_of_functions[""""]',     self::IS_INVALID),
+            array('array_of_functions["\""]',     self::IS_VALID),
             array('array_of_functions["k\"e\""]', self::IS_VALID),
             array('array_of_functions["k\'ey"]',  self::IS_VALID),
             array("array_of_functions['k'ey']",   self::IS_INVALID),
@@ -62,6 +65,8 @@ public static function dataProviderForTestValidate()
             array("array_of_functions['\'key']",  self::IS_VALID),
             array("array_of_functions['key\'']",  self::IS_VALID),
             array("array_of_functions['k'ey'']",  self::IS_INVALID),
+            array("array_of_functions[''']",      self::IS_INVALID),
+            array("array_of_functions['\'']",     self::IS_VALID),
         );
     }
 }