diff options
| author | Reed Loden <reed@reedloden.com> | 2014-07-09 08:37:29 +0200 |
|---|---|---|
| committer | Byron Jones <glob@mozilla.com> | 2014-07-09 08:37:29 +0200 |
| commit | 4c9f4e703dd840d58d7d2f6a4cd34ea72d891c9e (patch) | |
| tree | e8469bfa44091409f5bb23198e6845dc8dba0a6e | |
| parent | fce9ee9c0eee843140bf09511b574f65d00e24f6 (diff) | |
| download | bugzilla-4c9f4e703dd840d58d7d2f6a4cd34ea72d891c9e.tar.gz bugzilla-4c9f4e703dd840d58d7d2f6a4cd34ea72d891c9e.tar.xz | |
Bug 1036213: fix jsonrpc.cgi callback
| -rw-r--r-- | Bugzilla/WebService/Server/JSONRPC.pm | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/Bugzilla/WebService/Server/JSONRPC.pm b/Bugzilla/WebService/Server/JSONRPC.pm index 109c530b7..0df4240e0 100644 --- a/Bugzilla/WebService/Server/JSONRPC.pm +++ b/Bugzilla/WebService/Server/JSONRPC.pm @@ -92,7 +92,9 @@ sub response { # Implement JSONP. if (my $callback = $self->_bz_callback) { my $content = $response->content; - $response->content("$callback($content)"); + # Prepend the JSONP response with /**/ in order to protect + # against possible encoding attacks (e.g., affecting Flash). + $response->content("/**/$callback($content)"); } # Use $cgi->header properly instead of just printing text directly. |