SOLR-111 : Validate JSONP callback function name to avoid XSS

Author: seboo

src/java/fr/paris/lutece/plugins/search/solr/web/SolrSuggestServlet.java

@@ -59,6 +59,8 @@ public class SolrSuggestServlet extends HttpServlet
 {
     private static final long serialVersionUID = -3273825949482572338L;
 
+    private static final String CALLBACK_FUNCTION_NAME_ERROR_MESSAGE = "Callback function name must match [_\\-A-Za-z0-9]+" ;
+    
     public void init(  )
     {
     }
@@ -76,6 +78,13 @@ public String getSuggest( HttpServletRequest request )
 
         SolrSearchEngine engine = SolrSearchEngine.getInstance(  );
         StringBuffer result = new StringBuffer(  );
+
+        // XSS control
+        if (callback == null || !callback.matches( "[_\\-A-Za-z0-9]+" ))
+        {
+            return CALLBACK_FUNCTION_NAME_ERROR_MESSAGE;
+        }
+
         result.append( callback );
 
         result.append( "({\"response\":{\"docs\":[" );