author | Giulio Cesare Solaroli <giulio.cesare@clipperz.com> | 2014-05-02 15:14:18 (UTC) |
---|---|---|
committer | Giulio Cesare Solaroli <giulio.cesare@clipperz.com> | 2014-05-02 15:24:45 (UTC) |
commit | ed6b4edc82b0f65c77980713cd525053fcbc1dd2 (patch) (side-by-side diff) | |
tree | 80eb0e6ccfc4efa15c6488cc83448d8a865169df /frontend/beta/js/Clipperz/Base.js | |
parent | 03659f6b3d9766898854e8a769c0c9341b3de80c (diff) | |
download | clipperz-ed6b4edc82b0f65c77980713cd525053fcbc1dd2.zip clipperz-ed6b4edc82b0f65c77980713cd525053fcbc1dd2.tar.gz clipperz-ed6b4edc82b0f65c77980713cd525053fcbc1dd2.tar.bz2 |
Fixed issues reported by cure53.de
Fixed issues CLP-01-014 and CLP-01-015
Diffstat (limited to 'frontend/beta/js/Clipperz/Base.js') (more/less context) (ignore whitespace changes)
-rw-r--r-- | frontend/beta/js/Clipperz/Base.js | 28 |
1 files changed, 28 insertions, 0 deletions
diff --git a/frontend/beta/js/Clipperz/Base.js b/frontend/beta/js/Clipperz/Base.js index cf40314..1c6faa1 100644 --- a/frontend/beta/js/Clipperz/Base.js +++ b/frontend/beta/js/Clipperz/Base.js @@ -225,48 +225,76 @@ MochiKit.Base.update(Clipperz.Base, { return JSON2.parse(aString); }, 'serializeJSON': function(anObject) { // return MochiKit.Base.serializeJSON(anObject); return JSON2.stringify(anObject); }, //------------------------------------------------------------------------- 'sanitizeString': function(aValue) { var result; if (Clipperz.Base.objectType(aValue) == 'string') { result = aValue; result = result.replace(/</img,"<"); result = result.replace(/>/img,">"); } else { result = aValue; } return result; }, + 'javascriptInjectionPattern': new RegExp("javascript:\/\/\"", "g"), + + 'sanitizeUrl': function(aValue) { + var result; + + if ((aValue != null) && this.javascriptInjectionPattern.test(aValue)) { + result = aValue.replace(this.javascriptInjectionPattern, ''); + console.log("sanitized url", aValue, result); + } else { + result = aValue; + } + + return result; + }, + + 'sanitizeFavicon': function(aValue) { + var result; + + if ((aValue != null) && this.javascriptInjectionPattern.test(aValue)) { + result = aValue.replace(this.javascriptInjectionPattern, ''); + console.log("sanitized favicon", aValue, result); + } else { + result = aValue; + } + + return result; + }, + //------------------------------------------------------------------------- 'exception': { 'AbstractMethod': new MochiKit.Base.NamedError("Clipperz.Base.exception.AbstractMethod"), 'UnknownType': new MochiKit.Base.NamedError("Clipperz.Base.exception.UnknownType"), 'VulnerabilityIssue': new MochiKit.Base.NamedError("Clipperz.Base.exception.VulnerabilityIssue") }, //------------------------------------------------------------------------- __syntaxFix__: "syntax fix" }); MochiKit.Base.registerComparator('Object dummy comparator', function(a, b) { return ((a.constructor == Object) && (b.constructor == Object)); }, function(a, b) { var result; var aKeys; var bKeys; |