symfony/symfony — pull request #11367 by FineWolf (2014-07-10 13:40:56+00:00)
Title: [HttpFoundation] Fix to prevent magic bytes injection in JSONP responses... (CVE-2014-4671)

| Q | A
| ------------- | ---
| Bug fix? | yes
| New feature? | no
| BC breaks? | no*
| Deprecations? | no
| Tests pass? | yes
| Fixed tickets | N/A
| License | MIT
| Doc PR | N/A
| CVE Ticket | [CVE-2014-4671](http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-4671)
| See Also | [Rosetta Flash](http://miki.it/blog/2014/7/8/abusing-jsonp-with-rosetta-flash/)

* Unless you are parsing the response string manually, which you really shouldn't do anyway

**THIS IS A SECURITY FIX AND SHOULD BE MERGED SHORTLY**

This fix prevents attacks vectors where third-party browser plugins depends on ASCII magic bytes in order to execute a plugin. This is currently exploited with Flash using a carefully crafted JSONP response, allowing the execution of random SWF data from a domain with a vulnerable JSONP endpoint.

This security issue is mitigated by adding an empty comment right before the callback parameter. This does not affect the execution of the JSONP callback.