Skip to content
  • Lukas Fleischer's avatar
    Mitigate JSONP callback vulnerabilities · 209b0b6e
    Lukas Fleischer authored
    The callback parameter of the RPC interface currently allows for
    specifying a prefix of arbitrary length of the returned result. This can
    be exploited by certain attacks.
    As a countermeasure, this patch restricts the allowed character set for
    the callback name to letters, digits, underscores, parenthesis and dots.
    It also limits the length of the name to 128 characters. Furthermore,
    the reflected callback name is now always prepended with "/**/", which
    is a common workaround to protect against attacks such as Rosetta Flash.
    Fixes FS#46259.
    Signed-off-by: default avatarLukas Fleischer <>