Page Menu
Home
Phabricator
Search
Configure Global Search
Log In
Files
F14102
bug68187.patch
Public
Actions
View File
Edit File
Delete File
View Transforms
Subscribe
Mute Notifications
Award Token
Flag For Later
Authored By
•
bzimport
Nov 22 2014, 3:26 AM
2014-11-22 03:26:00 (UTC+0)
Size
1 KB
Referenced Files
None
Subscribers
None
bug68187.patch
View Options
From f41e4987e3747be52f25a0511510ba7d49bcc605 Mon Sep 17 00:00:00 2001
From: csteipp <csteipp@wikimedia.org>
Date: Thu, 17 Jul 2014 13:24:56 -0700
Subject: [PATCH] SECURITY: Prepend jsonp callback with comment
Mitigate CVE-2014-4671 for unpatched flash players
Bug: 68187
Change-Id: I2f46e623c1f541dbbafb6e8333e0929055098b15
---
includes/api/ApiFormatJson.php | 4 +++-
tests/phpunit/includes/api/format/ApiFormatJsonTest.php | 5 +++++
2 files changed, 8 insertions(+), 1 deletion(-)
diff --git a/includes/api/ApiFormatJson.php b/includes/api/ApiFormatJson.php
index e2c6b9a..6c5ad38 100644
--- a/includes/api/ApiFormatJson.php
+++ b/includes/api/ApiFormatJson.php
@@ -66,7 +66,9 @@ class ApiFormatJson extends ApiFormatBase {
$callback = $params['callback'];
if ( $callback !== null ) {
$callback = preg_replace( "/[^][.\\'\\\"_A-Za-z0-9]/", '', $callback );
- $this->printText( "$callback($json)" );
+ # Prepend a comment to try to avoid attacks against content
+ # sniffers, such as bug 68187.
+ $this->printText( "/**/$callback($json)" );
} else {
$this->printText( $json );
}
diff --git a/tests/phpunit/includes/api/format/ApiFormatJsonTest.php b/tests/phpunit/includes/api/format/ApiFormatJsonTest.php
index c71faec..fc1f902 100644
--- a/tests/phpunit/includes/api/format/ApiFormatJsonTest.php
+++ b/tests/phpunit/includes/api/format/ApiFormatJsonTest.php
@@ -14,4 +14,9 @@ class ApiFormatJsonTest extends ApiFormatTestBase {
$this->assertInternalType( 'array', json_decode( $data, true ) );
$this->assertGreaterThan( 0, count( (array)$data ) );
}
+
+ public function testJsonpInjection( ) {
+ $data = $this->apiRequest( 'json', array( 'action' => 'query', 'meta' => 'siteinfo', 'callback' => 'myCallback' ) );
+ $this->assertEquals( '/**/myCallback(', substr( $data, 0, 15 ) );
+ }
}
--
1.8.4.5
File Metadata
Details
Attached
Mime Type
text/x-diff
Storage Engine
blob
Storage Format
Raw Data
Storage Handle
13519
Default Alt Text
bug68187.patch (1 KB)
Attached To
Mode
T70187: Mitigate CVE-2014-4671 (jsonp flash)
Attached
Detach File
Event Timeline
Log In to Comment