Skip to content

Commit 1c824b6

Browse files
committed
Added support for the Angular Json protection vulnerability when parsing json (see https://docs.angularjs.org/api/ng/service/$http#json-vulnerability-protection)thanks to @riann (https://github.com/riaann) for this!!Added documentation for the new 'adapter' config property and tests around the node js multifetch adapter.
1 parent d6b22a5 commit 1c824b6

File tree

10 files changed

+279
-16
lines changed

10 files changed

+279
-16
lines changed

README.md

Lines changed: 63 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -2,10 +2,11 @@ Angular Http Batcher - enabling transparent HTTP batch request with AngularJS
22
====================
33

44
The biggest performance boost you will get with modern single page style apps is to reduce the number of HTTP request you
5-
send. This module has been designed to batch http requests to the same endpoint following the http 1.1 batch spec. All
6-
you need to do is configure the batch endpoint with the library and the rest is taken care of.
5+
send. This module has been designed to batch http requests to the same endpoint following the http 1.1 batch spec and after the
6+
1.11.0 update it can now support multiple any number of batch formats and I'm planning to implement that Facebook batch protocol
7+
very soon. All you need to do is configure the batch endpoint with the library and the rest is taken care of!
78

8-
See my original blog blog for a detailed overview - http://jonsamwell.com/batching-http-requests-in-angular/
9+
See my original blog post for a detailed overview - http://jonsamwell.com/batching-http-requests-in-angular/
910

1011
<h3 id="angular-http-batcher-getting-started">Getting Started</h3>
1112

@@ -51,7 +52,7 @@ angular.module('myApp', ['jcs.angular-http-batch']);
5152

5253
The root endpoint url is simply the base address of your api and the endpoint batch address is the url of the method that can accept the batch request (usually just /batch or /$batch). You are able to pass some optional configuration paramaters to this call in the third argument (see below)
5354

54-
The setAllowedBatchEndpoint has some options that can be passed in as a third paramter to the call which are explained below.
55+
The setAllowedBatchEndpoint has some options that can be passed in as a third parameter to the call which are explained below.
5556

5657
```language-javascript
5758
{
@@ -60,10 +61,67 @@ The setAllowedBatchEndpoint has some options that can be passed in as a third pa
6061
batchRequestCollectionDelay: 100,
6162
ignoredVerbs: ['head'],
6263
sendCookies: false,
63-
enabled: true
64+
enabled: true,
65+
adapter: 'httpBatchAdapter' //defaults to this value we currently also support a node js multifetch format as well
6466
}
6567
```
6668

69+
####adapter
70+
The key for the adapter to use. Defaults to the HTTP 1.1 adapter 'httpBatchAdapter'.
71+
Current adapters are:
72+
'httpBatchAdapter' - supports the HTTP 1.1 spec and used by .Net (WebAPI) and JAVA servers.
73+
'nodeJsMultiFetchAdapter' - supports batching GET requests to a node server that uses the multifetch library.
74+
Coming soon:
75+
'facebookAdapter' - will support the facebook batching protocol.
76+
77+
Please request adapters that are not present.
78+
79+
Adapters convert http requests into a single batch request and parse the batch response. They consist of two methods defined below.
80+
81+
This adapter parameter can also be an object with the two below functions if you need to be more specific about the way
82+
requests and responses are handled.
83+
84+
```javascript
85+
/**
86+
* Builds the single batch request from the given batch of pending requests.
87+
* Returns a standard angular httpConfig object that will be use to invoke the $http service.
88+
* See:
89+
* https://developers.google.com/storage/docs/json_api/v1/how-tos/batch
90+
* http://blogs.msdn.com/b/webdev/archive/2013/11/01/introducing-batch-support-in-web-api-and-web-api-odata.aspx
91+
*
92+
* @param requests - the collection of pending http request to build into a single http batch request.
93+
* @param config - the http batch config.
94+
* @returns {object} - a http config object.
95+
*/
96+
function buildRequestFn(requests, config) {
97+
var httpConfig = {
98+
method: 'POST',
99+
url: config.batchEndpointUrl,
100+
cache: false,
101+
headers: config.batchRequestHeaders || {}
102+
};
103+
104+
// do processing...
105+
106+
return httpConfig;
107+
}
108+
109+
/**
110+
* Parses the raw response into an array of HttpBatchResponseData objects. If is this methods job
111+
* to parse the response and match it up with the orginal request object.
112+
* @param rawResponse
113+
* @param config
114+
* @returns {Array.HttpBatchResponseData[]}
115+
*/
116+
function parseResponseFn(requests, rawResponse, config) {
117+
var batchResponses = []; // array of HttpBatchResponseData
118+
119+
//do processing..
120+
121+
return batchResponses;
122+
}
123+
```
124+
67125
####maxBatchedRequestPerCall
68126
The maximum number of single http request that are allow to be sent in one http batch request. If this limit is reached the call will be split up into multiple batch requests. This option defaults to 10 request per batch but it is probably worth playing around with this number to see the optimal batch size between total request size and response speed.
69127

bower.json

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
{
22
"name": "angular-http-batcher",
3-
"version": "1.11.0",
3+
"version": "1.11.1",
44
"description": "Enables transparent HTTP batch requests with Angular",
55
"main": "dist/angular-http-batch.js",
66
"keywords": [

dist/ChangeLog.txt

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,8 @@
1+
11/08/2015 V1.11.1
2+
Added support for the Angular Json protection vulnerability when parsing json (see https://docs.angularjs.org/api/ng/service/$http#json-vulnerability-protection)
3+
thanks to @riann (https://github.com/riaann) for this!!
4+
Added documentation for the new 'adapter' config property and tests around the node js multifetch adapter.
5+
16
10/08/2015 V1.11.0
27
HUGE refactor of the library geared towards supporting multiple different formats of batch request and response i.e.
38
http 1.1 batch, NodeJS, Facebook etc. The library now has the concept of batch adapters which are able to transform raw

dist/angular-http-batch.js

Lines changed: 15 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* angular-http-batcher - v1.11.0 - 2015-08-10
2+
* angular-http-batcher - v1.11.1 - 2015-08-11
33
* https://github.com/jonsamwell/angular-http-batcher
44
* Copyright (c) 2015 Jon Samwell
55
*/
@@ -210,14 +210,27 @@ function addRequestFn(request) {
210210
return true;
211211
}
212212

213+
/**
214+
* see https://docs.angularjs.org/api/ng/service/$http#json-vulnerability-protection
215+
* @param data
216+
* @returns {*|void|string}
217+
*/
218+
function trimJsonProtectionVulnerability(data) {
219+
return data !== undefined ? data.replace(')]}\',\n', '') : data;
220+
}
221+
213222
function sendFn() {
214223
var self = this,
215224
adapter = self.getAdapter(),
216225
httpBatchConfig = adapter.buildRequest(self.requests, self.config);
217226

218227
self.sendCallback();
219228
self.$injector.get('$http')(httpBatchConfig).then(function (response) {
220-
var batchResponses = adapter.parseResponse(self.requests, response, self.config);
229+
var batchResponses;
230+
231+
response.data = trimJsonProtectionVulnerability(response.data);
232+
233+
batchResponses = adapter.parseResponse(self.requests, response, self.config);
221234

222235
angular.forEach(batchResponses, function (batchResponse) {
223236
batchResponse.request.callback(

dist/angular-http-batch.min.js

Lines changed: 2 additions & 2 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

package.json

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
{
22
"name": "angular-http-batcher",
3-
"version": "1.11.0",
3+
"version": "1.11.1",
44
"description": "Enables transparent HTTP batch requests with Angular",
55
"main": "angular-http-batcher.min.js",
66
"scripts": {

src/services/adapters/nodeJsMultiFetchAdapter.js

Lines changed: 2 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -50,10 +50,9 @@ function NodeJsMultiFetchAdapter() {
5050
* Parses the raw response into an array of HttpBatchResponseData objects. If is this methods job
5151
* to parse the response and match it up with the orginal request object.
5252
* @param rawResponse
53-
* @param config
5453
* @returns {Array.HttpBatchResponseData[]}
5554
*/
56-
function parseResponseFn(requests, rawResponse, config) {
55+
function parseResponseFn(requests, rawResponse) {
5756
var batchResponses = [],
5857
i, request,
5958
responseData = rawResponse.data,
@@ -77,10 +76,9 @@ function NodeJsMultiFetchAdapter() {
7776
/**
7877
* Gaurd method to ensure the adapter supports this given request.
7978
* @param request
80-
* @param config
8179
* @returns {boolean} false to indicate the request type is not supported.
8280
*/
83-
function canBatchRequestFn(request, config) {
81+
function canBatchRequestFn(request) {
8482
return request.method === 'GET';
8583
}
8684
}

src/services/httpBatcher.js

Lines changed: 14 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -34,14 +34,27 @@ function addRequestFn(request) {
3434
return true;
3535
}
3636

37+
/**
38+
* see https://docs.angularjs.org/api/ng/service/$http#json-vulnerability-protection
39+
* @param data
40+
* @returns {*|void|string}
41+
*/
42+
function trimJsonProtectionVulnerability(data) {
43+
return data !== undefined ? data.replace(')]}\',\n', '') : data;
44+
}
45+
3746
function sendFn() {
3847
var self = this,
3948
adapter = self.getAdapter(),
4049
httpBatchConfig = adapter.buildRequest(self.requests, self.config);
4150

4251
self.sendCallback();
4352
self.$injector.get('$http')(httpBatchConfig).then(function (response) {
44-
var batchResponses = adapter.parseResponse(self.requests, response, self.config);
53+
var batchResponses;
54+
55+
response.data = trimJsonProtectionVulnerability(response.data);
56+
57+
batchResponses = adapter.parseResponse(self.requests, response, self.config);
4558

4659
angular.forEach(batchResponses, function (batchResponse) {
4760
batchResponse.request.callback(

0 commit comments

Comments
 (0)