JSONP capability seems to return invalid JS as injected script to HTML

[dlcurry]

Current code in createRouter.js: var JSONPWRAP = exports.JSONPWRAP = function(namespace, data) { return 'function ' + namespace + '() {\ return "' + data + '"\ }'; };

Given a wrapper function name of wrap, returns: function wrap() {"wrap(){ return "}) where is a well-formed JSON string.

This is unsuitable for HTML script injection, necessary for some solutions that need to work around SOP constraints. While the script is inserted, it cannot be executed because of the quotes around the function body and, possibly, because while the function is created, it is not necessarily called(???).

Recommend the following: var JSONPWRAP = exports.JSONPWRAP = function(namespace, data) { return data; };

with the nominal call of: callback(null, options.callback + '(' + data + ');');

This returns: wrap(data); which IS injectable and verified as a valid, well-formed and executed injection script.

NB: It is possible that the JSONP capability was created to satisfy non-HTML requirements. Perhaps the suggested code can be included as one of 2+ options for serving JSNOP.

[aaaasmile]

I am using jQuery to call the service with jsonp. To make it working, I have modified the createRouter.js like: var JSONPWRAP = exports.JSONPWRAP = function(namespace, data) { var str_p = "" + namespace + '(' + data + ')'; return str_p; }; the caller with this: result_p = JSONPWRAP(requestHandler.request.params[0].callback, result); ... res.send(response.statusCode, {'Content-Type': contentType}, result_p);

In my demoModule I use following: data = {[1,'b', 'hello']}; callback(null, data);