kapytein / jsonp Goto Github PK

Currently, the plugin only checks whether the request responds with application/javascript after appending parameters and/or changing the extension of the URL. However, there could be cases where the JSONP endpoint responds with a different content type (for some reason).

If no header is present that prevents content sniffing (X-Content-Type-Options: nosniff), you could either use it to leak data cross-origin, or use it for a CSP bypass.

A suggested solution by @avlidienbrunn was to check the start of the response instead.

https://github.com/kapytein/jsonp/blob/master/jsonp.py#L124.

The IHttpRequestResponse object is from the original request, while we should include the altered request by the extension. Currently, as a temporary solution, the callback URL is included in the issue description.

As mentioned https://support.portswigger.net/customer/portal/questions/16743855-byte-to-ihttprequestresponse, we probably need to create our own class which creates a IHttpRequestResponse object from a byte[] object.