Changeset 8694

Timestamp:

01/23/08 00:57:38 (6 months ago)

Author:

tobie

Message:

prototype: Prevent a potential security issue for cross-site ajax requests.

Files:

• spinoffs/prototype/branches/1-5-1/CHANGELOG (modified) (1 diff)
• spinoffs/prototype/branches/1-5-1/Rakefile (modified) (1 diff)
• spinoffs/prototype/branches/1-5-1/src/ajax.js (modified) (3 diffs)
• spinoffs/prototype/branches/1-5-1/test/lib/jstest.rb (modified) (3 diffs)
• spinoffs/prototype/branches/1-5-1/test/unit/ajax.html (modified) (1 diff)

spinoffs/prototype/branches/1-5-1/CHANGELOG

@@ +1 @@
+*1.5.1.2* (January 18, 2008)
+
+* Prevent a potential security issue for cross-site ajax requests. [sam, Tobie Langel]
+
-*1.5.1.1* (June 19, 2007)
-

spinoffs/prototype/branches/1-5-1/Rakefile

@@ -6 +6 @@
-PROTOTYPE_DIST_DIR = File.join(PROTOTYPE_ROOT, 'dist')
-PROTOTYPE_PKG_DIR  = File.join(PROTOTYPE_ROOT, 'pkg')
-1
+2
-
-task :default => [:dist, :package, :clean_package_source]

spinoffs/prototype/branches/1-5-1/src/ajax.js

@@ -188 +188 @@
-      
-      var contentType = this.getHeader('Content-type');
-
+this.isSameOrigin() && 
-        match(/^(text|application)\/(x-)?(java|ecma)script(;.*)?$/i))
-          this.evalResponse();
@@ -206 +206 @@
-  },
-  
+  isSameOrigin: function() {
+    var m = this.url.match(/^\s*https?:\/\/[^/]*/);
+    return !m || (m[0] == new Template('#{protocol}//#{domain}#{port}').evaluate({
+      protocol: location.protocol,
+      domain: document.domain,
+      port: location.port ? ':' + location.port : ''
+    }));
+  },
+  
-  getHeader: function(name) {
-    try {
@@ -215 +224 @@
-    try {
-      var json = this.getHeader('X-JSON');
-
+!this.isSameOrigin()
-    } catch (e) { return null }
-  },

spinoffs/prototype/branches/1-5-1/test/lib/jstest.rb

@@ -147 +147 @@
-end
-
-
-
-
-
-
-
-
-
-
-
-
+
+
-    res['ETag'] = nil
-    res['Last-Modified'] = Time.now + 100**4
@@ -166 +157 @@
-end
-
+class BasicServlet < WEBrick::HTTPServlet::AbstractServlet
+  def do_GET(req, res)
+    prevent_caching(res)
+    res['Content-Type'] = "text/plain"
+    
+    req.query.each do |k, v|
+      res[k] = v unless k == 'responseBody'
+    end
+    res.body = req.query["responseBody"]
+    
+    raise WEBrick::HTTPStatus::OK
+  end
+  
+  def do_POST(req, res)
+    do_GET(req, res)
+  end
+end
+
+class NonCachingFileHandler < WEBrick::HTTPServlet::FileHandler
+  def do_GET(req, res)
+    super
+    set_default_content_type(res, req.path)
+    prevent_caching(res)
+  end
+  
+  def set_default_content_type(res, path)
+    res['Content-Type'] = case path
+      when /\.js$/   then 'text/javascript'
+      when /\.html$/ then 'text/html'
+      when /\.css$/  then 'text/css'
+      else 'text/plain'
+    end
+  end
+end
+
-
-class JavaScriptTestTask < ::Rake::TaskLib
@@ -186 +212 @@
-      res.body = req["content-type"]
-    end
+    @server.mount("/response", BasicServlet)
-    
-    yield self if block_given?

spinoffs/prototype/branches/1-5-1/test/unit/ajax.html

@@ -174 +174 @@
-        onComplete: function(transport) { assertNotEqual(0, transport.readyState) }
-      });
+    }},
+
+    testIsSameOriginMethod: function() {with(this) {
+      var isSameOrigin = Ajax.Request.prototype.isSameOrigin;
+      assert(isSameOrigin.call({ url: '/foo/bar.html' }), '/foo/bar.html');
+      assert(isSameOrigin.call({ url: window.location.toString() }), window.location);
+      assert(!isSameOrigin.call({ url: 'http://example.com' }), 'http://example.com');
+
+      if (window.location.port == 4711) {
+        Ajax.Request.prototype.isSameOrigin = function() {
+          return false
+        };
+
+        $("content").update('same origin policy');
+        new Ajax.Request("/response", {
+          parameters: {
+            responseBody:   '$("content").update("<H2>Hello world!</H2>");', 
+            'Content-Type': '           text/javascript     '
+          },
+          asynchronous: false,
+          method: 'get',
+          onException: function(e) { throw e },
+          onComplete: function(transport) { 
+            assertEqual("same origin policy", $("content").innerHTML);
+          }
+        });
+
+        new Ajax.Request("/response", {
+          parameters: { 'X-JSON': '{});window.attacked = true;({}' },
+          asynchronous: false,
+          method: 'get',
+          onComplete: function(transport, json) {
+            assertNull(json);
+          }
+        });
+
+        Ajax.Request.prototype.isSameOrigin = isSameOrigin;
+      } else {
+        info('You must be running your tests from rake to test this feature.');
+      }
-    }}
-    
-  }, 'testlog');
-// ]]>