Merge pull request #93 from justintv/master

Fix CVE-2014-4671
rack · Sep 21, 2014 · 1b11346 · 1b11346
2 parents 5c12ace + 2dd3b22
commit 1b11346
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/lib/rack/contrib/jsonp.rb b/lib/rack/contrib/jsonp.rb
@@ -99,7 +99,7 @@ def pad(callback, response, body = "")
       # https://github.com/rack/rack-contrib/issues/46
       response.close if response.respond_to?(:close)
 
-      ["#{callback}(#{body})"]
+      ["/**/#{callback}(#{body})"]
     end
 
     def bad_request(body = "Bad Request")