diogo/symfony
Archived
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

[HttpFoundation] Fix to prevent magic bytes injection in JSONP responses (Prevents CVE-2014-4671)

Browse Source
This commit is contained in:
Andrew Moore 2014-07-10 09:27:11 -04:00
parent ca69dbba43
commit 6af3d05b85
2 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
src/Symfony/Component/HttpFoundation/JsonResponse.php
View File

@ -111,7 +111,7 @@ class JsonResponse extends Response
// Not using application/javascript for compatibility reasons with older browsers.
$this->headers->set('Content-Type', 'text/javascript');
return $this->setContent(sprintf('%s(%s);', $this->callback, $this->data));
return $this->setContent(sprintf('/**/%s(%s);', $this->callback, $this->data));
}
// Only set the header when there is none or when it equals 'text/javascript' (from a previous update with callback)

2
src/Symfony/Component/HttpFoundation/Tests/JsonResponseTest.php
View File

@ -155,7 +155,7 @@ class JsonResponseTest extends \PHPUnit_Framework_TestCase
{
$response = JsonResponse::create(array('foo' => 'bar'))->setCallback('callback');
$this->assertEquals('callback({"foo":"bar"});', $response->getContent());
$this->assertEquals('/**/callback({"foo":"bar"});', $response->getContent());
$this->assertEquals('text/javascript', $response->headers->get('Content-Type'));
}