limit callback to only used values (#3896)

Co-authored-by: Georgy Litvinov <[email protected]>
vivo-project · Jun 23, 2023 · b049158 · b049158
1 parent b4e7b1a
commit b049158
Showing 1 changed file with 8 additions and 2 deletions.
diff --git a/...cornell/mannlib/vitro/webapp/visualization/capabilitymap/CapabilityMapRequestHandler.java b/...cornell/mannlib/vitro/webapp/visualization/capabilitymap/CapabilityMapRequestHandler.java
@@ -31,12 +31,18 @@
 import edu.cornell.mannlib.vitro.webapp.visualization.visutils.VisualizationRequestHandler;
 import org.apache.commons.logging.Log;
 
+import java.util.Arrays;
 import java.util.HashMap;
 import java.util.HashSet;
 import java.util.Map;
 import java.util.Set;
 
 public class CapabilityMapRequestHandler implements VisualizationRequestHandler {
+
+    private static final String IPRET_FULL_RESULTS = "ipretFullResults";
+    private static final String IPRET_RESULTS = "ipretResults";
+    private static Set<String> callbackValues = new HashSet<String>(Arrays.asList(IPRET_FULL_RESULTS, IPRET_RESULTS));
+
     @Override
     public AuthorizationRequest getRequiredPrivileges() {
         return null;
@@ -109,7 +115,7 @@ public Object generateAjaxVisualization(VitroRequest vitroRequest, Log log, Data
             ObjectMapper mapper = new ObjectMapper();
 
             String callback = vitroRequest.getParameter("callback");
-            if (!StringUtils.isEmpty(callback)) {
+            if (!StringUtils.isEmpty(callback) && callbackValues.contains(callback)) {
                 return callback + "(" + mapper.writeValueAsString(response) + ");";
             }
             return mapper.writeValueAsString(response);
@@ -162,7 +168,7 @@ public Object generateAjaxVisualization(VitroRequest vitroRequest, Log log, Data
 
             ObjectMapper mapper = new ObjectMapper();
             String callback = vitroRequest.getParameter("callback");
-            if (!StringUtils.isEmpty(callback)) {
+            if (!StringUtils.isEmpty(callback) && callbackValues.contains(callback)) {
                 return callback + "(" + mapper.writeValueAsString(response) + ");";
             }
             return mapper.writeValueAsString(response);