From 9951ab2d2a1b4d7ff3db16fd2dba349cbbb69385 Mon Sep 17 00:00:00 2001
From: "bzrmirror%bugzilla.org"
 <bzrmirror%bugzilla.org@18797224-902f-48f8-a5cc-f745e15eee43>
Date: Thu, 24 Jul 2014 17:45:51 +0000
Subject: [PATCH] Bug 1036213 - (CVE-2014-1546) add '/**/' before jsonrpc.cgi
 callback to avoid swf content type sniff vulnerability r=glob,a=sgreen

git-svn-id: svn://10.0.0.236/trunk@265475 18797224-902f-48f8-a5cc-f745e15eee43
---
 mozilla/webtools/bugzilla/.bzrrev                             | 2 +-
 mozilla/webtools/bugzilla/.gitrev                             | 2 +-
 .../webtools/bugzilla/Bugzilla/WebService/Server/JSONRPC.pm   | 4 +++-
 3 files changed, 5 insertions(+), 3 deletions(-)

diff --git a/mozilla/webtools/bugzilla/.bzrrev b/mozilla/webtools/bugzilla/.bzrrev
index ddef961be3d..f19e4c1dfbc 100644
--- a/mozilla/webtools/bugzilla/.bzrrev
+++ b/mozilla/webtools/bugzilla/.bzrrev
@@ -1 +1 @@
-9087
\ No newline at end of file
+9088
\ No newline at end of file
diff --git a/mozilla/webtools/bugzilla/.gitrev b/mozilla/webtools/bugzilla/.gitrev
index a8848dcf303..6fda401d4fa 100644
--- a/mozilla/webtools/bugzilla/.gitrev
+++ b/mozilla/webtools/bugzilla/.gitrev
@@ -1 +1 @@
-cf3e8bc724148ac85f838b35b0b0bd72fa5f349f
\ No newline at end of file
+02ce906f56b0c127136fbdb7eaeef4012168a990
\ No newline at end of file
diff --git a/mozilla/webtools/bugzilla/Bugzilla/WebService/Server/JSONRPC.pm b/mozilla/webtools/bugzilla/Bugzilla/WebService/Server/JSONRPC.pm
index 5290caa5d08..177e2618dda 100644
--- a/mozilla/webtools/bugzilla/Bugzilla/WebService/Server/JSONRPC.pm
+++ b/mozilla/webtools/bugzilla/Bugzilla/WebService/Server/JSONRPC.pm
@@ -80,7 +80,9 @@ sub response {
     # Implement JSONP.
     if (my $callback = $self->_bz_callback) {
         my $content = $response->content;
-        $response->content("$callback($content)");
+        # Prepend the JSONP response with /**/ in order to protect
+        # against possible encoding attacks (e.g., affecting Flash).
+        $response->content("/**/$callback($content)");
     }
 
     # Use $cgi->header properly instead of just printing text directly.