Bug 1036213 - (CVE-2014-1546) add '/**/' before jsonrpc.cgi callback to avoid swf content type sniff vulnerability

r=glob,a=sgreen


git-svn-id: svn://10.0.0.236/trunk@265475 18797224-902f-48f8-a5cc-f745e15eee43

mozilla/webtools/bugzilla/Bugzilla/WebService/Server/JSONRPC.pm

@@ -80,7 +80,9 @@ sub response {
     # Implement JSONP.
     if (my $callback = $self->_bz_callback) {
         my $content = $response->content;
-        $response->content("$callback($content)");
+        # Prepend the JSONP response with /**/ in order to protect
+        # against possible encoding attacks (e.g., affecting Flash).
+        $response->content("/**/$callback($content)");
     }
 
     # Use $cgi->header properly instead of just printing text directly.