1 | const Polling = require("./polling");
|
---|
2 | const qs = require("querystring");
|
---|
3 | const rDoubleSlashes = /\\\\n/g;
|
---|
4 | const rSlashes = /(\\)?\\n/g;
|
---|
5 |
|
---|
6 | class JSONP extends Polling {
|
---|
7 | /**
|
---|
8 | * JSON-P polling transport.
|
---|
9 | *
|
---|
10 | * @api public
|
---|
11 | */
|
---|
12 | constructor(req) {
|
---|
13 | super(req);
|
---|
14 |
|
---|
15 | this.head = "___eio[" + (req._query.j || "").replace(/[^0-9]/g, "") + "](";
|
---|
16 | this.foot = ");";
|
---|
17 | }
|
---|
18 |
|
---|
19 | /**
|
---|
20 | * Handles incoming data.
|
---|
21 | * Due to a bug in \n handling by browsers, we expect a escaped string.
|
---|
22 | *
|
---|
23 | * @api private
|
---|
24 | */
|
---|
25 | onData(data) {
|
---|
26 | // we leverage the qs module so that we get built-in DoS protection
|
---|
27 | // and the fast alternative to decodeURIComponent
|
---|
28 | data = qs.parse(data).d;
|
---|
29 | if ("string" === typeof data) {
|
---|
30 | // client will send already escaped newlines as \\\\n and newlines as \\n
|
---|
31 | // \\n must be replaced with \n and \\\\n with \\n
|
---|
32 | data = data.replace(rSlashes, function(match, slashes) {
|
---|
33 | return slashes ? match : "\n";
|
---|
34 | });
|
---|
35 | super.onData(data.replace(rDoubleSlashes, "\\n"));
|
---|
36 | }
|
---|
37 | }
|
---|
38 |
|
---|
39 | /**
|
---|
40 | * Performs the write.
|
---|
41 | *
|
---|
42 | * @api private
|
---|
43 | */
|
---|
44 | doWrite(data, options, callback) {
|
---|
45 | // we must output valid javascript, not valid json
|
---|
46 | // see: http://timelessrepo.com/json-isnt-a-javascript-subset
|
---|
47 | const js = JSON.stringify(data)
|
---|
48 | .replace(/\u2028/g, "\\u2028")
|
---|
49 | .replace(/\u2029/g, "\\u2029");
|
---|
50 |
|
---|
51 | // prepare response
|
---|
52 | data = this.head + js + this.foot;
|
---|
53 |
|
---|
54 | super.doWrite(data, options, callback);
|
---|
55 | }
|
---|
56 | }
|
---|
57 |
|
---|
58 | module.exports = JSONP;
|
---|