id,summary,reporter,owner,description,type,status,priority,milestone,component,resolution,keywords,cc,repo,theme
1057,JSONP parameter isn't escaped,dread,,"{{{
$ curl ""http://127.0.0.1:5000/api/rest/package/annakarenina?callback=<script>jsoncallback""
}}}
gives:
{{{
<script>jsoncallback({""id"": ""c10ebd31-5b45-4f6f-885d-dca9b18caec4"", ""name"": ""annakarenina"", ""title"": ""A Novel By Tolstoy"",
}}}
which could run script code in the client who made the call.

One idea for filtering: http://tav.espians.com/sanitising-jsonp-callback-identifiers-for-security.html
Maybe just better to have a restricted whitelist of characters to be even more sure.

Same as: https://trac.dataco.coi.gov.uk/projects/datagov/ticket/906",defect,closed,critical,,ckan,fixed,,,ckan,none