GHSA-p9fg-j6ww-953m
GHSA-p9fg-j6ww-953m · FOSRestBundle issue with broken validation of JSONP callbacks
Здесь приведены факты из открытых источников об уязвимостях. Перед обновлением ознакомьтесь с исходным сообщением.
Starting with FOSRestBundle 1.2 we [switched](https://github.com/FriendsOfSymfony/FOSRestBundle/pull/642/files#diff-431bc57ca9ca16332c0cff43ad45263cR37) to using [willdurand/jsonp-callback-validator](https://github.com/willdurand/JsonpCallbackValidator) for validation of JSONP callbacks. However [the change was implemented](https://github.com/FriendsOfSymfony/FOSRestBundle/pull/665) incorrectly validating the callback query param name, rather than its value. Anyone using the JSONP handler (which is off by default) together with FOSRestBundle 1.2.0 or 1.2.1 should update to FOSRestBundle [1.2.2](https://github.com/FriendsOfSymfony/FOSRestBundle/releases/tag/1.2.2).
Есть исправление
- Опубликовано
- Обновлено
Стек: php
Затронутые продукты и версии
friendsofsymfony/rest-bundle Packagist
- Версии
- 1.2.0
- 1.2.1
- Затронутые диапазоны версий
- ECOSYSTEM: ≥ 1.2.0, < 1.2.2
Обновитесь до 1.2.2
Первоисточники
- https://github.com/FriendsOfSymfony/FOSRestBundle/commit/3dd7d40068360c23366fb4884c5d194c769ec2c1
- https://github.com/FriendsOfPHP/security-advisories/blob/master/friendsofsymfony/rest-bundle/2014-01-22-1.yaml
- https://github.com/FriendsOfSymfony/FOSRestBundle
- https://symfony.com/blog/fosrestbundle-security-issue-with-jsonp-handler
- https://osv.dev/vulnerability/GHSA-p9fg-j6ww-953m