Changeset 8693

Timestamp:

01/23/08 00:51:25 (8 months ago)

Author:

tobie

Message:

prototype: Prevent a potential security issue for cross-site ajax requests.

Files:

• spinoffs/prototype/trunk/CHANGELOG (modified) (1 diff)
• spinoffs/prototype/trunk/src/ajax.js (modified) (4 diffs)
• spinoffs/prototype/trunk/test/unit/ajax.html (modified) (1 diff)

spinoffs/prototype/trunk/CHANGELOG

@@ -1 +1 @@
-*SVN*
+
+* Prevent a potential security issue for cross-site ajax requests. [Alexey Feldgendler, sam, Tobie Langel]
-
-* Test for attribute existence before applying more complex CSS3 selectors. Closes #10870. [arty, Tobie Langel]

spinoffs/prototype/trunk/src/ajax.js

@@ -190 +190 @@
-      var contentType = response.getHeader('Content-type');
-      if (this.options.evalJS == 'force'
-
+this.isSameOrigin() && 
-          && contentType.match(/^\s*(text|application)\/(x-)?(java|ecma)script(;.*)?\s*$/i)))
-        this.evalResponse();
@@ -206 +206 @@
-      this.transport.onreadystatechange = Prototype.emptyFunction;
-    }
+  },
+  
+  isSameOrigin: function() {
+    var m = this.url.match(/^\s*https?:\/\/[^/]*/);
+    return !m || (m[0] == '#{protocol}//#{domain}#{port}'.interpolate({
+      protocol: location.protocol,
+      domain: document.domain,
+      port: location.port ? ':' + location.port : ''
+    }));
-  },
-  
@@ -283 +292 @@
-    json = decodeURIComponent(escape(json));
-    try {
-
+
+
-    } catch (e) {
-      this.request.dispatchException(e);
@@ -296 +306 @@
-          return null;
-    try {
-
+
+
-    } catch (e) {
-      this.request.dispatchException(e);

spinoffs/prototype/trunk/test/unit/ajax.html

@@ -411 +411 @@
-        info(message);
-      }
+    }},
+    
+    testIsSameOriginMethod: function() {with(this) {
+      var isSameOrigin = Ajax.Request.prototype.isSameOrigin;
+      assert(isSameOrigin.call({ url: '/foo/bar.html' }), '/foo/bar.html');
+      assert(isSameOrigin.call({ url: window.location.toString() }), window.location);
+      assert(!isSameOrigin.call({ url: 'http://example.com' }), 'http://example.com');
+
+      if (isRunningFromRake) {
+        Ajax.Request.prototype.isSameOrigin = function() {
+          return false
+        };
+
+        $("content").update('same origin policy');
+        new Ajax.Request("/response", extendDefault({
+          parameters: Fixtures.js,
+          onComplete: function(transport) { 
+            assertEqual("same origin policy", $("content").innerHTML);
+          }
+        }));
+
+        new Ajax.Request("/response", extendDefault({
+          parameters: Fixtures.invalidJson,
+          onException: function(request, error) {
+            assert(error.message.include('Badly formed JSON string'));
+          }
+        }));
+
+        new Ajax.Request("/response", extendDefault({
+          parameters: { 'X-JSON': '{});window.attacked = true;({}' },
+          onException: function(request, error) {
+            assert(error.message.include('Badly formed JSON string'));
+          }
+        }));
+
+        Ajax.Request.prototype.isSameOrigin = isSameOrigin;
+      } else {
+        info(message);
+      }
-    }}
-  });