JsonResponse.php 7.4 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221
  1. <?php
  2. /*
  3. * This file is part of the Symfony package.
  4. *
  5. * (c) Fabien Potencier <fabien@symfony.com>
  6. *
  7. * For the full copyright and license information, please view the LICENSE
  8. * file that was distributed with this source code.
  9. */
  10. namespace Symfony\Component\HttpFoundation;
  11. /**
  12. * Response represents an HTTP response in JSON format.
  13. *
  14. * Note that this class does not force the returned JSON content to be an
  15. * object. It is however recommended that you do return an object as it
  16. * protects yourself against XSSI and JSON-JavaScript Hijacking.
  17. *
  18. * @see https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/AJAX_Security_Cheat_Sheet.md#always-return-json-with-an-object-on-the-outside
  19. *
  20. * @author Igor Wiedler <igor@wiedler.ch>
  21. */
  22. class JsonResponse extends Response
  23. {
  24. protected $data;
  25. protected $callback;
  26. // Encode <, >, ', &, and " characters in the JSON, making it also safe to be embedded into HTML.
  27. // 15 === JSON_HEX_TAG | JSON_HEX_APOS | JSON_HEX_AMP | JSON_HEX_QUOT
  28. public const DEFAULT_ENCODING_OPTIONS = 15;
  29. protected $encodingOptions = self::DEFAULT_ENCODING_OPTIONS;
  30. /**
  31. * @param mixed $data The response data
  32. * @param int $status The response status code
  33. * @param array $headers An array of response headers
  34. * @param bool $json If the data is already a JSON string
  35. */
  36. public function __construct($data = null, int $status = 200, array $headers = [], bool $json = false)
  37. {
  38. parent::__construct('', $status, $headers);
  39. if ($json && !\is_string($data) && !is_numeric($data) && !\is_callable([$data, '__toString'])) {
  40. throw new \TypeError(sprintf('"%s": If $json is set to true, argument $data must be a string or object implementing __toString(), "%s" given.', __METHOD__, get_debug_type($data)));
  41. }
  42. if (null === $data) {
  43. $data = new \ArrayObject();
  44. }
  45. $json ? $this->setJson($data) : $this->setData($data);
  46. }
  47. /**
  48. * Factory method for chainability.
  49. *
  50. * Example:
  51. *
  52. * return JsonResponse::create(['key' => 'value'])
  53. * ->setSharedMaxAge(300);
  54. *
  55. * @param mixed $data The JSON response data
  56. * @param int $status The response status code
  57. * @param array $headers An array of response headers
  58. *
  59. * @return static
  60. *
  61. * @deprecated since Symfony 5.1, use __construct() instead.
  62. */
  63. public static function create($data = null, int $status = 200, array $headers = [])
  64. {
  65. trigger_deprecation('symfony/http-foundation', '5.1', 'The "%s()" method is deprecated, use "new %s()" instead.', __METHOD__, static::class);
  66. return new static($data, $status, $headers);
  67. }
  68. /**
  69. * Factory method for chainability.
  70. *
  71. * Example:
  72. *
  73. * return JsonResponse::fromJsonString('{"key": "value"}')
  74. * ->setSharedMaxAge(300);
  75. *
  76. * @param string $data The JSON response string
  77. * @param int $status The response status code
  78. * @param array $headers An array of response headers
  79. *
  80. * @return static
  81. */
  82. public static function fromJsonString(string $data, int $status = 200, array $headers = [])
  83. {
  84. return new static($data, $status, $headers, true);
  85. }
  86. /**
  87. * Sets the JSONP callback.
  88. *
  89. * @param string|null $callback The JSONP callback or null to use none
  90. *
  91. * @return $this
  92. *
  93. * @throws \InvalidArgumentException When the callback name is not valid
  94. */
  95. public function setCallback(string $callback = null)
  96. {
  97. if (null !== $callback) {
  98. // partially taken from https://geekality.net/2011/08/03/valid-javascript-identifier/
  99. // partially taken from https://github.com/willdurand/JsonpCallbackValidator
  100. // JsonpCallbackValidator is released under the MIT License. See https://github.com/willdurand/JsonpCallbackValidator/blob/v1.1.0/LICENSE for details.
  101. // (c) William Durand <william.durand1@gmail.com>
  102. $pattern = '/^[$_\p{L}][$_\p{L}\p{Mn}\p{Mc}\p{Nd}\p{Pc}\x{200C}\x{200D}]*(?:\[(?:"(?:\\\.|[^"\\\])*"|\'(?:\\\.|[^\'\\\])*\'|\d+)\])*?$/u';
  103. $reserved = [
  104. 'break', 'do', 'instanceof', 'typeof', 'case', 'else', 'new', 'var', 'catch', 'finally', 'return', 'void', 'continue', 'for', 'switch', 'while',
  105. 'debugger', 'function', 'this', 'with', 'default', 'if', 'throw', 'delete', 'in', 'try', 'class', 'enum', 'extends', 'super', 'const', 'export',
  106. 'import', 'implements', 'let', 'private', 'public', 'yield', 'interface', 'package', 'protected', 'static', 'null', 'true', 'false',
  107. ];
  108. $parts = explode('.', $callback);
  109. foreach ($parts as $part) {
  110. if (!preg_match($pattern, $part) || \in_array($part, $reserved, true)) {
  111. throw new \InvalidArgumentException('The callback name is not valid.');
  112. }
  113. }
  114. }
  115. $this->callback = $callback;
  116. return $this->update();
  117. }
  118. /**
  119. * Sets a raw string containing a JSON document to be sent.
  120. *
  121. * @return $this
  122. */
  123. public function setJson(string $json)
  124. {
  125. $this->data = $json;
  126. return $this->update();
  127. }
  128. /**
  129. * Sets the data to be sent as JSON.
  130. *
  131. * @param mixed $data
  132. *
  133. * @return $this
  134. *
  135. * @throws \InvalidArgumentException
  136. */
  137. public function setData($data = [])
  138. {
  139. try {
  140. $data = json_encode($data, $this->encodingOptions);
  141. } catch (\Exception $e) {
  142. if ('Exception' === \get_class($e) && 0 === strpos($e->getMessage(), 'Failed calling ')) {
  143. throw $e->getPrevious() ?: $e;
  144. }
  145. throw $e;
  146. }
  147. if (\PHP_VERSION_ID >= 70300 && (\JSON_THROW_ON_ERROR & $this->encodingOptions)) {
  148. return $this->setJson($data);
  149. }
  150. if (\JSON_ERROR_NONE !== json_last_error()) {
  151. throw new \InvalidArgumentException(json_last_error_msg());
  152. }
  153. return $this->setJson($data);
  154. }
  155. /**
  156. * Returns options used while encoding data to JSON.
  157. *
  158. * @return int
  159. */
  160. public function getEncodingOptions()
  161. {
  162. return $this->encodingOptions;
  163. }
  164. /**
  165. * Sets options used while encoding data to JSON.
  166. *
  167. * @return $this
  168. */
  169. public function setEncodingOptions(int $encodingOptions)
  170. {
  171. $this->encodingOptions = $encodingOptions;
  172. return $this->setData(json_decode($this->data));
  173. }
  174. /**
  175. * Updates the content and headers according to the JSON data and callback.
  176. *
  177. * @return $this
  178. */
  179. protected function update()
  180. {
  181. if (null !== $this->callback) {
  182. // Not using application/javascript for compatibility reasons with older browsers.
  183. $this->headers->set('Content-Type', 'text/javascript');
  184. return $this->setContent(sprintf('/**/%s(%s);', $this->callback, $this->data));
  185. }
  186. // Only set the header when there is none or when it equals 'text/javascript' (from a previous update with callback)
  187. // in order to not overwrite a custom definition.
  188. if (!$this->headers->has('Content-Type') || 'text/javascript' === $this->headers->get('Content-Type')) {
  189. $this->headers->set('Content-Type', 'application/json');
  190. }
  191. return $this->setContent($this->data);
  192. }
  193. }