{"record":{"id":"71cba4df5e273e93","repo":"languagetool-org/languagetool","slug":"callback-value-must-match-a-za-z-callback","errorCode":null,"errorMessage":"'callback' value must match [a-zA-Z]+: '{callback}'","messagePattern":"'callback' value must match \\[a-zA-Z\\]\\+: '(.+?)'","errorType":"validation","errorClass":"BadRequestException","httpStatus":400,"severity":"error","filePath":"languagetool-server/src/main/java/org/languagetool/server/TextChecker.java","lineNumber":1090,"sourceCode":"    QueryParams(List<Language> altLanguages, List<String> enabledRules, List<String> disabledRules, List<CategoryId> enabledCategories, List<CategoryId> disabledCategories,\n                boolean useEnabledOnly, boolean useQuerySettings, boolean allowIncompleteResults, boolean enableHiddenRules, boolean premium, boolean enableTempOffRules, JLanguageTool.Mode mode, JLanguageTool.Level level, Set<ToneTag> toneTags, @Nullable String callback, boolean inputLogging) {\n      this.altLanguages = Objects.requireNonNull(altLanguages);\n      this.enabledRules = enabledRules;\n      this.disabledRules = disabledRules;\n      this.enabledCategories = enabledCategories;\n      this.disabledCategories = disabledCategories;\n      this.useEnabledOnly = useEnabledOnly;\n      this.useQuerySettings = useQuerySettings;\n      this.allowIncompleteResults = allowIncompleteResults;\n      this.enableHiddenRules = enableHiddenRules;\n      this.premium = premium;\n      this.enableTempOffRules = enableTempOffRules;\n      this.regressionTestMode = enableTempOffRules;\n      this.mode = Objects.requireNonNull(mode);\n      this.level = Objects.requireNonNull(level);\n      this.toneTags = toneTags;\n      if (callback != null && !callback.matches(\"[a-zA-Z]+\")) {\n        throw new BadRequestException(\"'callback' value must match [a-zA-Z]+: '\" + callback + \"'\");\n      }\n      this.callback = callback;\n      this.inputLogging = inputLogging;\n    }\n\n    @Override\n    public int hashCode() {\n      return new HashCodeBuilder()\n        .append(altLanguages)\n        .append(enabledRules)\n        .append(disabledRules)\n        .append(enabledCategories)\n        .append(disabledCategories)\n        .append(useEnabledOnly)\n        .append(useQuerySettings)\n        .append(allowIncompleteResults)\n        .append(enableHiddenRules)\n        .append(premium)","sourceCodeStart":1072,"sourceCodeEnd":1108,"githubUrl":"https://github.com/languagetool-org/languagetool/blob/2e990059ce67d5e2a0f7f7ca5d31160c6709df4b/languagetool-server/src/main/java/org/languagetool/server/TextChecker.java#L1072-L1108","documentation":"The JSONP 'callback' parameter must consist only of ASCII letters ([a-zA-Z]+); anything else (digits, underscores, dots, brackets) is rejected to prevent injection into the JSONP response body. The constructor of the request-validation class enforces this regex whenever callback is non-null.","triggerScenarios":"Calling /v2/check with callback=my_func, callback=cb1, callback=jQuery123... — any callback containing non-letter characters.","commonSituations":"Frameworks auto-generating callbacks like jQuery12345_ or __jsonp_cb_0; developers adding underscores for readability; client-side JSONP helpers that append counters.","solutions":["Use a callback of letters only, e.g. 'myCallback' or 'jsonpCallback'","Sanitize/strip non-letter characters from the callback before sending","Generate a letters-only random suffix if uniqueness is needed (e.g. 'callbackXyzAbc')","Drop the callback parameter entirely and consume plain JSON with fetch/axios"],"exampleFix":"// before\nparams.put(\"callback\", \"jQuery123_456\");\n// after\nparams.put(\"callback\", \"jQueryCallback\");","handlingStrategy":"validation","validationCode":"if (!/^[a-zA-Z]+$/.test(callback)) throw new Error('callback must be letters only');","typeGuard":"const isValidCallback = (cb) => typeof cb === 'string' && /^[a-zA-Z]+$/.test(cb);","tryCatchPattern":null,"preventionTips":["Strip non-letters from generated callback names","Prefer plain JSON over JSONP in modern clients","Add a unit test asserting callback format before requests"],"tags":["http","api","validation","jsonp"],"backgroundTag":"invalid-argument-value","analyzedSha":"2e990059ce67d5e2a0f7f7ca5d31160c6709df4b","analyzedAt":"2026-09-06T09:20:17.015Z","contentChangedAt":"2026-09-06T09:20:17.015Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}