a4befd9382fadf413884d2215012535d5d667063
braney
  Mon Aug 17 13:46:45 2026 -0700
hgApi, hgTracks: tighten callback parameter validation, refs #38126 #38057

Add isValidJsonpCallback() and apply it to the callback-name paths in
apiOut() and the hgTracks jsonp output, so only C-symbol dotted names are
echoed back.

diff --git src/inc/cheapcgi.h src/inc/cheapcgi.h
index f60e578e7ea..30db46edd9d 100644
--- src/inc/cheapcgi.h
+++ src/inc/cheapcgi.h
@@ -676,17 +676,24 @@
 /* Free up list of cgiParsedVars */
 
 char *cgiScriptDirUrl();
 /* Return the cgi-bin directory path on this webserver.
  * This is not the local directory but the <path> part after the server
  * in external URLs to this webserver.
  * e.g. if CGI is called via http://localhost/subdir/cgi-bin/cgiTest
  * the returned string is /subdir/. Must be free'd. */
 
 void cgiChangeVar(char *varName, char *value);
 /* An entry point to change the value of a something passed to us on the URL. */
 
 void cgiSetMaxLogLen(int l);
 /* set the size of variable values that are dumped to stderr. Default is 0, which means no logging */
 
+boolean isValidJsonpCallback(char *s);
+/* Return TRUE if s is safe to use as a JSONP callback name: non-empty, not
+ * too long, and every dot-separated segment is a C symbol (letters, digits,
+ * underscore, not starting with a digit).  This rejects anything with
+ * parentheses, spaces, operators, or other characters that would let an
+ * attacker turn a same-origin JSONP response into arbitrary script. */
+
 #endif /* CHEAPCGI_H */