#0905
Your API supports JSONP by wrapping the JSON response in a caller-supplied callback name: callbackName({...}).
The validateCallback function currently accepts any string, allowing an attacker to supply );alert(1);// as the callback name.
This causes the rendered response to execute );alert(1);//({...}) in any browser that loads the JSONP endpoint, resulting in XSS.
JSONP is still widely used in legacy APIs. Without strict callback validation any XSS filter can be bypassed because the payload is served from a trusted first-party domain.
validateCallback to only accept valid JavaScript identifier characters./^[a-zA-Z_$][a-zA-Z0-9_$.]*$/ (dots permitted for namespaced callbacks like jQuery.fn).'Invalid callback' for any other input; return the callback unchanged if valid.validateCallback(');alert(1);//')// returns ');alert(1);//' — XSS!
validateCallback(');alert(1);//')// throws Error('Invalid callback')
'Invalid callback' — no other message.jQuery.ajax.success).