Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fixes client DOM Cookie Poisoning #3982

Closed
wants to merge 13 commits into from
Closed

Fixes client DOM Cookie Poisoning #3982

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
13 commits
Select commit Hold shift + click to select a range
853b3a5
Fixes cookie poisoning issue
walmazacn Oct 4, 2024
5a24e7b
Adds Prettier fixes
walmazacn Oct 4, 2024
d0d5c60
Adds bundle size fix
walmazacn Oct 4, 2024
b5c9ef8
Adds minor refactoring
walmazacn Oct 4, 2024
4a65fc4
Merge branch 'main' into 3981-checkmarx-one-cookie-poisoning
walmazacn Oct 7, 2024
848d55e
Fixes reported issue
walmazacn Oct 7, 2024
c542f4e
Adds Prettier fixes
walmazacn Oct 7, 2024
b5e318b
Fixes reported issue
walmazacn Oct 7, 2024
b2d1953
Fixes reported issue
walmazacn Oct 8, 2024
9371af1
Fixes reported issue
walmazacn Oct 8, 2024
8478d20
Merge branch 'main' into 3981-checkmarx-one-cookie-poisoning
walmazacn Oct 10, 2024
6ec63d1
Merge branch 'main' into 3981-checkmarx-one-cookie-poisoning
JohannesDoberer Oct 14, 2024
0faf077
Merge branch 'main' into 3981-checkmarx-one-cookie-poisoning
walmazacn Oct 14, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
42 changes: 24 additions & 18 deletions client/src/lifecycleManager.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -143,36 +143,42 @@ class LifecycleManager extends LuigiClientBase {
if (this.currentContext?.internal?.thirdPartyCookieCheck?.disabled || this.disableTpcCheck) {
return;
}

const winParent = window.parent;
const targetOrigin = winParent.origin !== 'null' ? winParent.origin : '*';
const luigiCookieValue = 'luigiCookie=true';
const sanitizeString = input =>
input ? input.replace(/[^a-z0-9%._=;]/gim, '') : '';
const getLuigiCookie = cookies =>
cookies
.split(';')
.map(cookie => sanitizeString(cookie))
.find(cookie => cookie === luigiCookieValue);
let cookies = sanitizeString(document.cookie);
let tpc = 'enabled';
let cookies = document.cookie;
let luigiCookie;
let luigiCookieKey;

if (cookies) {
luigiCookie = cookies
.split(';')
.map(cookie => cookie.trim())
.find(cookie => cookie == 'luigiCookie=true');
luigiCookie = getLuigiCookie(cookies);
}
if (luigiCookie === 'luigiCookie=true') {
luigiCookieKey = luigiCookie.split('=')[0];
if (luigiCookie === luigiCookieValue) {
luigiCookieKey = luigiCookieValue.split('=')[0];
document.cookie = luigiCookieKey + '=; Max-Age=-99999999; SameSite=None; Secure';
}
document.cookie = 'luigiCookie=true; SameSite=None; Secure';
cookies = document.cookie;

document.cookie = luigiCookieValue + '; SameSite=None; Secure';
cookies = sanitizeString(document.cookie);

if (cookies) {
luigiCookie = cookies
.split(';')
.map(cookie => cookie.trim())
.find(cookie => cookie == 'luigiCookie=true');
luigiCookie = getLuigiCookie(cookies);
}
if (luigiCookie === 'luigiCookie=true') {
window.parent.postMessage({ msg: 'luigi.third-party-cookie', tpc }, '*');
document.cookie = luigiCookieKey + '=; Max-Age=-99999999; SameSite=None; Secure';
} else {
if (luigiCookie !== luigiCookieValue) {
tpc = 'disabled';
window.parent.postMessage({ msg: 'luigi.third-party-cookie', tpc }, '*');
console.warn('Third party cookies are not supported!');
}

winParent.postMessage({ msg: 'luigi.third-party-cookie', tpc }, targetOrigin);
}

/**
Expand Down
45 changes: 26 additions & 19 deletions core/third-party-cookies/init.html
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,32 +1,39 @@
<body>
<script>
let cookies = document.cookie;
<script type="text/javascript">
const winParent = window.parent;
const targetOrigin = winParent.origin !== 'null' ? winParent.origin : '*';
const luigiCookieValue = 'luigiCookie=true';
const sanitizeString = input =>
input ? input.replace(/[^a-z0-9%._=;]/gim, '') : '';
const getLuigiCookie = cookies =>
cookies
.split(';')
.map(cookie => sanitizeString(cookie))
.find(cookie => cookie === luigiCookieValue);
let cookies = sanitizeString(document.cookie);
let tpc = 'enabled';
let luigiCookie;
let luigiCookieKey;

if (cookies) {
luigiCookie = cookies
.split(';')
.map(cookie => cookie.trim())
.find(cookie => cookie == 'luigiCookie=true');
luigiCookie = getLuigiCookie(cookies);
}
if (luigiCookie === 'luigiCookie=true') {
luigiCookieKey = luigiCookie.split('=')[0];
if (luigiCookie === luigiCookieValue) {
luigiCookieKey = luigiCookieValue.split('=')[0];
document.cookie = luigiCookieKey + '=; Max-Age=-99999999; SameSite=None; Secure';
}
document.cookie = 'luigiCookie=true; SameSite=None; Secure';
cookies = document.cookie;

document.cookie = luigiCookieValue + '; SameSite=None; Secure';
cookies = sanitizeString(document.cookie);

if (cookies) {
luigiCookie = cookies
.split(';')
.map(cookie => cookie.trim())
.find(cookie => cookie == 'luigiCookie=true');
luigiCookie = getLuigiCookie(cookies);
}
if (luigiCookie === 'luigiCookie=true') {
window.parent.postMessage('luigi.tpcEnabled', '*');
document.cookie = luigiCookieKey + '=; Max-Age=-99999999; SameSite=None; Secure';
} else {
window.parent.postMessage('luigi.tpcDisabled', '*');
if (luigiCookie !== luigiCookieValue) {
tpc = 'disabled';
console.warn('Third party cookies are not supported!');
}

winParent.postMessage({ msg: 'luigi.third-party-cookie', tpc }, targetOrigin);
</script>
</body>