adding validation to callback name

api/render.go

@@ -1,11 +1,13 @@
 package api
 
 import (
+	"regexp"
 	"net/http"
 	"github.com/unrolled/render"
 )
 
 var defaultRenderer = render.New(render.Options{})
+var validJsonpCallback = regexp.MustCompile(`(?i)^[$A-Z_][0-9A-Z_$]*$`)
 
 func Render(w http.ResponseWriter, req *http.Request, status int, v interface{}) {
 	vars := req.URL.Query()
@@ -24,7 +26,14 @@ func Render(w http.ResponseWriter, req *http.Request, status int, v interface{})
 	}
 
 	if callback, ok := vars["callback"]; ok {
-		defaultRenderer.JSONP(w, status, callback[0], v)
+		if validJsonpCallback.MatchString(callback[0]) {
+			defaultRenderer.JSONP(w, status, callback[0], v)
+		} else {
+			defaultRenderer.JSON(w, 400, map[string]string{
+				"name": "InvalidCallbackNameError",
+				"message": "Callback must be a valid javascript function name",
+			})
+		}
 	} else {
 		defaultRenderer.JSON(w, status, v)
 	}