Ruby on Rails | Screencasts | Download | Documentation | Weblog | Community | Source

Ticket #7910: secureJSON.diff

File secureJSON.diff, 2.5 kB (added by Tobie, 2 years ago)

still without String#removeSecurityDelimiter

  • test/unit/string.html

    old new  
    409409      attackTarget = "Not scared!"; 
    410410      assertRaise('SyntaxError', function(){dangerous.evalJSON(true)}); 
    411411      assertEqual("Not scared!", attackTarget); 
    412      }} 
     412 
     413      assertEqual('hello world!', ('/*-secure-\n' + valid + '\n*/').evalJSON().test); 
     414      var temp = Prototype.SecurityDelimiterPattern; 
     415      Prototype.SecurityDelimiterPattern = /^\/\*(.*)\*\/$/; // test custom delimiters. 
     416      assertEqual('hello world!', ('/*' + valid + '*/').evalJSON().test); 
     417      Prototype.SecurityDelimiterPattern = temp; 
     418    }} 
    413419  }, 'testlog'); 
    414420// ]]> 
    415421</script> 

  • src/prototype.js

    old new  
    1919   
    2020  ScriptFragment: '(?:<script.*?>)((\n|\r|.)*?)(?:<\/script>)', 
    2121  emptyFunction: function() {}, 
    22   K: function(x) { return x } 
     22  K: function(x) { return x }, 
     23  SecurityDelimiterPattern: /^\/\*-secure-\s*(.*)\s*\*\/\s*$/ 
    2324} 
    2425 
    2526<%= include 'base.js', 'string.js' %> 

  • src/string.js

    old new  
    164164  }, 
    165165 
    166166  evalJSON: function(sanitize) { 
     167    var json = this.sub(Prototype.SecurityDelimiterPattern, function(m){return m[1];}); 
    167168    try { 
    168       if (!sanitize || (/^("(\\.|[^"\\\n\r])*?"|[,:{}\[\]0-9.\-+Eaeflnr-u \n\r\t])+?$/.test(this))) 
    169         return eval('(' + this + ')'); 
     169      if (!sanitize || (/^("(\\.|[^"\\\n\r])*?"|[,:{}\[\]0-9.\-+Eaeflnr-u \n\r\t])+?$/.test(json))) 
     170        return eval('(' + json + ')'); 
    170171    } catch (e) {} 
    171172    throw new SyntaxError('Badly formated JSON string: ' + this.inspect()); 
    172173  }, 

  • src/ajax.js

    old new  
    212212  evalJSON: function() { 
    213213    try { 
    214214      var json = this.getHeader('X-JSON'); 
    215       return json ? eval('(' + json + ')') : null; 
     215      return json ? json.evalJSON() : null; 
    216216    } catch (e) { return null } 
    217217  }, 
    218218   
    219219  evalResponse: function() { 
    220220    try { 
    221       return eval(this.transport.responseText); 
     221      return eval(this.transport.responseText. 
     222        sub(Prototype.SecurityDelimiterPattern, function(m){ return m[1] })); 
    222223    } catch (e) { 
    223224      this.dispatchException(e); 
    224225    }