bug68187.patch
Public
Actions

Authored By

	• bzimport
	Nov 22 2014, 3:26 AM

Size

1 KB

Referenced Files

None

Subscribers

None

bug68187.patch
View Options

	From f41e4987e3747be52f25a0511510ba7d49bcc605 Mon Sep 17 00:00:00 2001
	From: csteipp <csteipp@wikimedia.org>
	Date: Thu, 17 Jul 2014 13:24:56 -0700
	Subject: [PATCH] SECURITY: Prepend jsonp callback with comment

	Mitigate CVE-2014-4671 for unpatched flash players

	Bug: 68187
	Change-Id: I2f46e623c1f541dbbafb6e8333e0929055098b15
	---
	includes/api/ApiFormatJson.php \| 4 +++-
	tests/phpunit/includes/api/format/ApiFormatJsonTest.php \| 5 +++++
	2 files changed, 8 insertions(+), 1 deletion(-)

	diff --git a/includes/api/ApiFormatJson.php b/includes/api/ApiFormatJson.php
	index e2c6b9a..6c5ad38 100644
	--- a/includes/api/ApiFormatJson.php
	+++ b/includes/api/ApiFormatJson.php
	@@ -66,7 +66,9 @@ class ApiFormatJson extends ApiFormatBase {
	$callback = $params['callback'];
	if ( $callback !== null ) {
	$callback = preg_replace( "/[^][.\\'\\\"_A-Za-z0-9]/", '', $callback );
	- $this->printText( "$callback($json)" );
	+ # Prepend a comment to try to avoid attacks against content
	+ # sniffers, such as bug 68187.
	+ $this->printText( "/**/$callback($json)" );
	} else {
	$this->printText( $json );
	}
	diff --git a/tests/phpunit/includes/api/format/ApiFormatJsonTest.php b/tests/phpunit/includes/api/format/ApiFormatJsonTest.php
	index c71faec..fc1f902 100644
	--- a/tests/phpunit/includes/api/format/ApiFormatJsonTest.php
	+++ b/tests/phpunit/includes/api/format/ApiFormatJsonTest.php
	@@ -14,4 +14,9 @@ class ApiFormatJsonTest extends ApiFormatTestBase {
	$this->assertInternalType( 'array', json_decode( $data, true ) );
	$this->assertGreaterThan( 0, count( (array)$data ) );
	}
	+
	+ public function testJsonpInjection( ) {
	+ $data = $this->apiRequest( 'json', array( 'action' => 'query', 'meta' => 'siteinfo', 'callback' => 'myCallback' ) );
	+ $this->assertEquals( '/**/myCallback(', substr( $data, 0, 15 ) );
	+ }
	}
	--
	1.8.4.5

File Metadata

Mime Type: text/x-diff
Storage Engine: blob
Storage Format: Raw Data
Storage Handle: 13519
Default Alt Text: bug68187.patch (1 KB)

bug68187.patchPublicActions

bug68187.patchView Options

File Metadata

Event Timeline

bug68187.patch
Public
Actions

bug68187.patch
View Options