OpenRefine / OpenRefine/OpenRefine
Drop JSONP support for reconciliation APIs
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 12k
- Forks
- 2.2k
- Avg merge
- 1d 14h
- Merged PRs (30d)
- 27
Description
Users should not be allowed to give remote services injection/JSONP capabilities given the danger. Today someone might just add a malicious service for a popular database to the testbench and only provide JSONP support and then all users trying it will be compromised without warning.
Proposed solution
Only three services on the test bench which do not support CORS supports JSONP so I suggest we drop support.
Alternatives considered
#7185 would allow us to keep supporting non-CORS enabled services while dropping JSONP. I personally don't think we should wait.
Additional context
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by locating the reconciliation APIs and their JSONP handling, then inspect the testbench services that currently rely on JSONP. Done means JSONP support is removed without affecting CORS-enabled reconciliation, with coverage confirming the supported request paths.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript
- Domain
- api, security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100