implement a text/json-comment-filtered mimetype to allow servers to cooperate in avoiding "JavaScript hijacking" attacks

[alex]

enhance our default text/json handling w/ an alternate mimetype (text/json-comment-filtered). Merge into the 0.4.x branch.

[alex]

(In [7811]) adding a text/json-comment-filtered type to the IO system. Refs #2656

[guest]

This change has the side effect of outputing a message : "please consider using a mimetype of text/json-comment-filtered to avoid potential security issues with JSON endpoints" on the console when using the default dp : incrementalComboBoxDataProvider (mimetype is hard-coded in line 69 of ComboBox?.js)

[bill]

See http://dojotoolkit.org/node/619 or ​http://www.fortifysoftware.com/servlet/downloads/public/JavaScript_Hijacking.pdf for details on why this is a serious problem (and why adding // fixes it).

[guest]

from [email protected]… :

I agree this is a good solution but may be it would (poor english...) be interesting to change the default mimetype in the incrementalComboBoxDataProvider.

[James Burke]

(In [8608]) Refs #2656. Porting json comment support to 0.4 branch

[James Burke]

(In [8609]) Refs #2656. Making the test output a bit more readable.

[(none)]

Milestone 0.4.3 deleted