Skip to content

Commit 78e50de

Browse files
authored
Merge pull request #3174 from nrotta/master
Fixes #3155 - Calling reply without a payload on a JSONP route throws
2 parents 9d8d617 + b7dbd2a commit 78e50de

File tree

2 files changed

+21
-1
lines changed

2 files changed

+21
-1
lines changed

lib/response.js

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -622,6 +622,6 @@ internals.Payload.prototype.jsonp = function (variable) {
622622

623623
this._sizeOffset = this._sizeOffset + variable.length + 7;
624624
this._prefix = '/**/' + variable + '('; // '/**/' prefix prevents CVE-2014-4671 security exploit
625-
this._data = Buffer.isBuffer(this._data) ? this._data : this._data.replace(/\u2028/g, '\\u2028').replace(/\u2029/g, '\\u2029');
625+
this._data = (this._data === null || Buffer.isBuffer(this._data)) ? this._data : this._data.replace(/\u2028/g, '\\u2028').replace(/\u2029/g, '\\u2029');
626626
this._suffix = ');';
627627
};

test/transmit.js

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -390,6 +390,26 @@ describe('transmission', () => {
390390
});
391391
});
392392

393+
it('returns an JSONP response with no payload', (done) => {
394+
395+
const handler = function (request, reply) {
396+
397+
return reply();
398+
};
399+
400+
const server = new Hapi.Server();
401+
server.connection();
402+
server.route({ method: 'GET', path: '/', config: { jsonp: 'callback', handler: handler } });
403+
404+
server.inject('/?callback=me', (res) => {
405+
406+
expect(res.payload).to.equal('/**/me();');
407+
expect(res.headers['content-length']).to.equal(9);
408+
expect(res.headers['content-type']).to.equal('text/javascript; charset=utf-8');
409+
done();
410+
});
411+
});
412+
393413
it('returns an JSONP response (no charset)', (done) => {
394414

395415
const handler = function (request, reply) {

0 commit comments

Comments
 (0)