Patched code sample

import re
import json
from flask import Flask, request, Response

# This is a minimal Flask application to represent the server-side logic.
# It demonstrates how to fix a JSONP callback vulnerability.
app = Flask(__name__)

# A whitelist regex for what is considered a valid JSONP callback function name.
# It allows alphanumeric characters, underscores, dots, and dollar signs.
# This pattern strictly prevents the inclusion of characters like parentheses,
# semicolons, angle brackets, or spaces that an attacker would use to inject
# arbitrary scripts.
VALID_CALLBACK_REGEX = re.compile(r'^[a-zA-Z0-9_$.]+$')


@app.route('/api/example_endpoint')
def example_endpoint():
    """
    An example API endpoint that supports JSONP and demonstrates the fix for
    an unsanitized callback parameter.
    """
    callback_name = request.args.get('callback')
    api_data = {"status": "success", "data": "some_value"}
    json_response = json.dumps(api_data)

    # If a 'callback' parameter is present in the request URL.
    if callback_name:
        # THE FIX:
        # Before using the callback name, it is validated against the strict
        # regular expression.
        if VALID_CALLBACK_REGEX.match(callback_name):
            # If the name is valid and safe, wrap the JSON response in the
            # requested function call.
            padded_response = f"{callback_name}({json_response})"
            return Response(padded_response, mimetype='application/javascript')
        else:
            # If the callback name is invalid (e.g., contains malicious characters
            # like 'alert(1);'), it is rejected. The server falls back to
            # returning a standard, unpadded JSON response. This prevents the
            # malicious script from being injected into the response.
            return Response(json_response, mimetype='application/json')

    # If no callback parameter is provided, return a standard JSON response.
    return Response(json_response, mimetype='application/json')