From b80c13b722bb207ddf43f53a007ee3ddc1dd2e26 Mon Sep 17 00:00:00 2001 From: Sebastien Deleuze Date: Fri, 8 Jun 2018 12:31:40 +0200 Subject: [PATCH] Deprecate JSONP and disable it by default in Jackson view Issue: SPR-16798 --- .../MappingJackson2HttpMessageConverter.java | 4 +++- .../converter/json/MappingJacksonValue.java | 8 +++++++- .../AbstractJsonpResponseBodyAdvice.java | 5 ++++- .../view/json/MappingJackson2JsonView.java | 17 ++++++++++++++--- .../view/json/MappingJackson2JsonViewTests.java | 14 ++++++++++++-- .../socket/sockjs/transport/TransportType.java | 6 +++++- .../transport/handler/DefaultSockJsService.java | 3 ++- .../handler/JsonpPollingTransportHandler.java | 4 +++- .../handler/JsonpReceivingTransportHandler.java | 4 +++- src/docs/asciidoc/web/webmvc-view.adoc | 7 ++++--- src/docs/asciidoc/web/webmvc.adoc | 5 +++++ 11 files changed, 62 insertions(+), 15 deletions(-) diff --git a/spring-web/src/main/java/org/springframework/http/converter/json/MappingJackson2HttpMessageConverter.java b/spring-web/src/main/java/org/springframework/http/converter/json/MappingJackson2HttpMessageConverter.java index 4e54a23f5f..f7818cb623 100644 --- a/spring-web/src/main/java/org/springframework/http/converter/json/MappingJackson2HttpMessageConverter.java +++ b/spring-web/src/main/java/org/springframework/http/converter/json/MappingJackson2HttpMessageConverter.java @@ -1,5 +1,5 @@ /* - * Copyright 2002-2017 the original author or authors. + * Copyright 2002-2018 the original author or authors. * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. @@ -91,6 +91,7 @@ public class MappingJackson2HttpMessageConverter extends AbstractJackson2HttpMes @Override + @SuppressWarnings("deprecation") protected void writePrefix(JsonGenerator generator, Object object) throws IOException { if (this.jsonPrefix != null) { generator.writeRaw(this.jsonPrefix); @@ -104,6 +105,7 @@ public class MappingJackson2HttpMessageConverter extends AbstractJackson2HttpMes } @Override + @SuppressWarnings("deprecation") protected void writeSuffix(JsonGenerator generator, Object object) throws IOException { String jsonpFunction = (object instanceof MappingJacksonValue ? ((MappingJacksonValue) object).getJsonpFunction() : null); diff --git a/spring-web/src/main/java/org/springframework/http/converter/json/MappingJacksonValue.java b/spring-web/src/main/java/org/springframework/http/converter/json/MappingJacksonValue.java index 49baa93a40..a99952689a 100644 --- a/spring-web/src/main/java/org/springframework/http/converter/json/MappingJacksonValue.java +++ b/spring-web/src/main/java/org/springframework/http/converter/json/MappingJacksonValue.java @@ -1,5 +1,5 @@ /* - * Copyright 2002-2017 the original author or authors. + * Copyright 2002-2018 the original author or authors. * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. @@ -115,14 +115,20 @@ public class MappingJacksonValue { /** * Set the name of the JSONP function name. + * @deprecated Will be removed as of Spring Framework 5.1, use + * CORS instead. */ + @Deprecated public void setJsonpFunction(@Nullable String functionName) { this.jsonpFunction = functionName; } /** * Return the configured JSONP function name. + * @deprecated Will be removed as of Spring Framework 5.1, use + * CORS instead. */ + @Deprecated @Nullable public String getJsonpFunction() { return this.jsonpFunction; diff --git a/spring-webmvc/src/main/java/org/springframework/web/servlet/mvc/method/annotation/AbstractJsonpResponseBodyAdvice.java b/spring-webmvc/src/main/java/org/springframework/web/servlet/mvc/method/annotation/AbstractJsonpResponseBodyAdvice.java index 0a383c6c57..55d7ffe14e 100644 --- a/spring-webmvc/src/main/java/org/springframework/web/servlet/mvc/method/annotation/AbstractJsonpResponseBodyAdvice.java +++ b/spring-webmvc/src/main/java/org/springframework/web/servlet/mvc/method/annotation/AbstractJsonpResponseBodyAdvice.java @@ -1,5 +1,5 @@ /* - * Copyright 2002-2015 the original author or authors. + * Copyright 2002-2018 the original author or authors. * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. @@ -45,7 +45,10 @@ import org.springframework.util.ObjectUtils; * * @author Rossen Stoyanchev * @since 4.1 + * @deprecated Will be removed as of Spring Framework 5.1, use + * CORS instead. */ +@Deprecated public abstract class AbstractJsonpResponseBodyAdvice extends AbstractMappingJacksonResponseBodyAdvice { /** diff --git a/spring-webmvc/src/main/java/org/springframework/web/servlet/view/json/MappingJackson2JsonView.java b/spring-webmvc/src/main/java/org/springframework/web/servlet/view/json/MappingJackson2JsonView.java index daf207984c..a6345ef9ef 100644 --- a/spring-webmvc/src/main/java/org/springframework/web/servlet/view/json/MappingJackson2JsonView.java +++ b/spring-webmvc/src/main/java/org/springframework/web/servlet/view/json/MappingJackson2JsonView.java @@ -1,5 +1,5 @@ /* - * Copyright 2002-2017 the original author or authors. + * Copyright 2002-2018 the original author or authors. * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. @@ -59,6 +59,7 @@ import org.springframework.web.servlet.View; * @author Sebastien Deleuze * @since 3.1.2 */ +@SuppressWarnings("deprecation") public class MappingJackson2JsonView extends AbstractJackson2View { /** @@ -69,7 +70,10 @@ public class MappingJackson2JsonView extends AbstractJackson2View { /** * Default content type for JSONP: "application/javascript". + * @deprecated Will be removed as of Spring Framework 5.1, use + * CORS instead. */ + @Deprecated public static final String DEFAULT_JSONP_CONTENT_TYPE = "application/javascript"; /** @@ -87,7 +91,7 @@ public class MappingJackson2JsonView extends AbstractJackson2View { private boolean extractValueFromSingleKeyModel = false; @Nullable - private Set jsonpParameterNames = new LinkedHashSet<>(Arrays.asList("jsonp", "callback")); + private Set jsonpParameterNames = new LinkedHashSet<>(); /** @@ -170,10 +174,14 @@ public class MappingJackson2JsonView extends AbstractJackson2View { * Set JSONP request parameter names. Each time a request has one of those * parameters, the resulting JSON will be wrapped into a function named as * specified by the JSONP request parameter value. - *

The parameter names configured by default are "jsonp" and "callback". + *

As of Spring Framework 5.0.7, there is no parameter name configured + * by default. * @since 4.1 * @see JSONP Wikipedia article + * @deprecated Will be removed as of Spring Framework 5.1, use + * CORS instead. */ + @Deprecated public void setJsonpParameterNames(Set jsonpParameterNames) { this.jsonpParameterNames = jsonpParameterNames; } @@ -204,7 +212,10 @@ public class MappingJackson2JsonView extends AbstractJackson2View { * Invalid parameter values are ignored. * @param value the query param value, never {@code null} * @since 4.1.8 + * @deprecated Will be removed as of Spring Framework 5.1, use + * CORS instead. */ + @Deprecated protected boolean isValidJsonpQueryParam(String value) { return CALLBACK_PARAM_PATTERN.matcher(value).matches(); } diff --git a/spring-webmvc/src/test/java/org/springframework/web/servlet/view/json/MappingJackson2JsonViewTests.java b/spring-webmvc/src/test/java/org/springframework/web/servlet/view/json/MappingJackson2JsonViewTests.java index 077f2dfa29..98258493e4 100644 --- a/spring-webmvc/src/test/java/org/springframework/web/servlet/view/json/MappingJackson2JsonViewTests.java +++ b/spring-webmvc/src/test/java/org/springframework/web/servlet/view/json/MappingJackson2JsonViewTests.java @@ -1,5 +1,5 @@ /* - * Copyright 2002-2016 the original author or authors. + * Copyright 2002-2018 the original author or authors. * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. @@ -17,9 +17,11 @@ package org.springframework.web.servlet.view.json; import java.io.IOException; +import java.util.Arrays; import java.util.Date; import java.util.HashMap; import java.util.HashSet; +import java.util.LinkedHashSet; import java.util.Map; import java.util.Set; @@ -324,11 +326,19 @@ public class MappingJackson2JsonViewTests { @Test public void renderWithJsonp() throws Exception { + testJsonp("jsonp", "callback", false); + testJsonp("jsonp", "_callback", false); + testJsonp("jsonp", "_Call.bAcK", false); + testJsonp("jsonp", "0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ_.", false); + testJsonp("jsonp", "