JSONP capability seems to return invalid JS as injected script to HTML

Nobody has claimed this yet.

Current code in createRouter.js:
var JSONPWRAP = exports.JSONPWRAP = function(namespace, data) {
return 'function ' + namespace + '() {\
return "' + data + '"\
}';
};

Given a wrapper function name of wrap, returns:
function wrap() {"wrap(){ return "})
where is a well-formed JSON string.

This is unsuitable for HTML script injection, necessary for some solutions that need to work around SOP constraints. While the script is inserted, it cannot be executed because of the quotes around the function body and, possibly, because while the function is created, it is not necessarily called(???).

Recommend the following:
var JSONPWRAP = exports.JSONPWRAP = function(namespace, data) {
return data;
};

with the nominal call of:
callback(null, options.callback + '(' + data + ');');

This returns:
wrap(data);
which IS injectable and verified as a valid, well-formed and executed injection script.

NB: It is possible that the JSONP capability was created to satisfy non-HTML requirements. Perhaps the suggested code can be included as one of 2+ options for serving JSNOP.

Start in createRouter.js at the JSONPWRAP function and inspect the callback invocation described in the issue. Verify whether the generated response is valid, executable JSONP for HTML script injection, and confirm the expected behavior with the existing project checks if available.

Written by the indexing model from the issue text.