CVE-2020-12480: CSRF in Play Framework

The vulnerability stemmed from improper handling of invalid Content-Type headers in CSRF protection logic. The patch added 'hasInvalidContentType' checks and modified conditional logic in multiple locations. The original vulnerable functions failed to account for: 1) Requests with unparseable Content-Type headers that would return contentType.isEmpty 2) The distinction between header presence vs valid parsing. This allowed attackers to craft requests with malformed Content-Type parameters to bypass blacklist-based CSRF protection. The functions handling CSRF check decisions (call, apply, requiresCsrfCheck) were directly modified in the security patch, indicating they contained the flawed logic.