[HttpFoundation] Fix to prevent magic bytes injection in JSONP responses (Prevents CVE-2014-4671)

Andrew Moore · Andrew Moore · commit 6af3d05b8511 · 2014-07-10T09:27:11.000-04:00
diff --git a/src/Symfony/Component/HttpFoundation/JsonResponse.php b/src/Symfony/Component/HttpFoundation/JsonResponse.php
@@ -111,7 +111,7 @@ protected function update()
             // Not using application/javascript for compatibility reasons with older browsers.
             $this->headers->set('Content-Type', 'text/javascript');
 
-            return $this->setContent(sprintf('%s(%s);', $this->callback, $this->data));
+            return $this->setContent(sprintf('/**/%s(%s);', $this->callback, $this->data));
         }
 
         // Only set the header when there is none or when it equals 'text/javascript' (from a previous update with callback)
diff --git a/src/Symfony/Component/HttpFoundation/Tests/JsonResponseTest.php b/src/Symfony/Component/HttpFoundation/Tests/JsonResponseTest.php
@@ -155,7 +155,7 @@ public function testSetCallback()
     {
         $response = JsonResponse::create(array('foo' => 'bar'))->setCallback('callback');
 
-        $this->assertEquals('callback({"foo":"bar"});', $response->getContent());
+        $this->assertEquals('/**/callback({"foo":"bar"});', $response->getContent());
         $this->assertEquals('text/javascript', $response->headers->get('Content-Type'));
     }
 

Original file line number	Diff line number	Diff line change
`@@ -111,7 +111,7 @@ protected function update()`
`111`	`111`	`// Not using application/javascript for compatibility reasons with older browsers.`
`112`	`112`	`$this->headers->set('Content-Type', 'text/javascript');`
`113`	`113`
`114`		`- return $this->setContent(sprintf('%s(%s);', $this->callback, $this->data));`
	`114`	`+ return $this->setContent(sprintf('/**/%s(%s);', $this->callback, $this->data));`
`115`	`115`	`}`
`116`	`116`
`117`	`117`	`// Only set the header when there is none or when it equals 'text/javascript' (from a previous update with callback)`
Original file line number	Diff line number	Diff line change
`@@ -155,7 +155,7 @@ public function testSetCallback()`
`155`	`155`	`{`
`156`	`156`	`$response = JsonResponse::create(array('foo' => 'bar'))->setCallback('callback');`
`157`	`157`
`158`		`- $this->assertEquals('callback({"foo":"bar"});', $response->getContent());`
	`158`	`+ $this->assertEquals('/**/callback({"foo":"bar"});', $response->getContent());`
`159`	`159`	`$this->assertEquals('text/javascript', $response->headers->get('Content-Type'));`
`160`	`160`	`}`
`161`	`161`