Permalink
Browse files

Merge branch 'rosetta_flash' of https://github.com/gcampbell/rails in…

…to gcampbell-rosetta_flash

* 'rosetta_flash' of https://github.com/gcampbell/rails:
  Address CVE-2014-4671 (JSONP Flash exploit)

Conflicts:
	actionpack/CHANGELOG.md
	actionpack/test/controller/mime/respond_to_test.rb
	actionpack/test/controller/render_json_test.rb
  • Loading branch information...
1 parent 02580fe commit f6007d621fe2c32385a53a3a401526239fd11b47 @tenderlove tenderlove committed with matthewd Jul 10, 2014
View
@@ -1,3 +1,8 @@
+* Prepend a JS comment to JSONP callbacks. Addresses CVE-2014-4671
+ ("Rosetta Flash")
+
+ *Greg Campbell*
+
* Generate shallow paths for all children of shallow resources.
Fixes #15783.
@@ -94,7 +94,7 @@ module All
self.content_type = Mime::JS
end
- "#{options[:callback]}(#{json})"
+ "/**/#{options[:callback]}(#{json})"
else
self.content_type ||= Mime::JSON
json
@@ -532,7 +532,7 @@ def test_format_with_custom_response_type_and_request_headers
def test_json_with_callback_sets_javascript_content_type
@request.accept = 'application/json'
get :json_with_callback
- assert_equal 'alert(JS)', @response.body
+ assert_equal '/**/alert(JS)', @response.body
assert_equal 'text/javascript', @response.content_type
end
@@ -101,7 +101,7 @@ def test_render_json_with_status
def test_render_json_with_callback
get :render_json_hello_world_with_callback
- assert_equal 'alert({"hello":"world"})', @response.body
+ assert_equal '/**/alert({"hello":"world"})', @response.body
assert_equal 'text/javascript', @response.content_type
end

0 comments on commit f6007d6

Please sign in to comment.