If the response did not parse as strict JSONP, the browser could throw an error or just ignore the entire response. However, this approach was abandoned in favor of CORS, and the correct MIME type for JSONP remains codice_9.<ref></ref>  JSONP carries the same problems as resolving JSON with : both interpret the JSON text as JavaScript, which means differences in handling U+2028 and U+2029 from JSON proper. This makes some JSON strings non-legal in JSONP; servers serving JSONP must escape these characters prior to transmission.<ref name="Magnus Holm"></ref>  Unsanitized callback names may be used to pass malicious data to clients, bypassing the restrictions associated with codice_10 content type, as demonstrated in reflected file download (RFD) attack from 2014.<ref></ref>  Insecure JSONP endpoints can be also injected with malicious data.<ref></ref>  Naive deployments of JSONP are subject to cross-site request forgery (CSRF or XSRF) attacks.<ref></ref> Because the HTML codice_1 tag does not respect the same-origin policy in web browser implementations, a malicious page can request and obtain JSON data belonging to another site. This will allow the JSON-encoded data to be evaluated in the context of the malicious page, possibly divulging passwords or other sensitive data if the user is currently logged into the other site. This is problematic only if the JSON-encoded data contains sensitive information which should not be disclosed to a third party, and the server depends on the same-origin policy of the browser to block the delivery of the sensitive information. Rosetta Flash is an exploitation technique that allows an attacker to exploit servers with a vulnerable JSONP endpoint by causing Adobe Flash Player to believe that an attacker-specified Flash applet originated on the vulnerable server. Flash Player implements same-origin policy allowing one to make requests (with cookies) and receive responses from the hosting site. The applet can then send the retrieved data back to the attacker. This is a cross-origin exploit with an impact similar to embedding an arbitrary Flash applet in the vulnerable domain. The exploit uses an ActionScript payload compiled to an SWF file composed entirely of alphanumeric characters by crafting a zlib stream with a particular header and DEFLATE blocks with ad-hoc Huffman coding. The resulting alphanumeric-only SWF file is then used as the callback parameter of a JSONP call.