Skip to content
This repository has been archived by the owner on Dec 11, 2019. It is now read-only.

validate that devServerPort is numeric #4753

Closed
diracdeltas opened this issue Oct 13, 2016 · 2 comments
Closed

validate that devServerPort is numeric #4753

diracdeltas opened this issue Oct 13, 2016 · 2 comments
Assignees
@diracdeltas
Labels
QA/checked-macOS QA/checked-Win32 QA/checked-Win64 security
Milestone
0.12.5dev

Comments

@diracdeltas
Copy link
Member

in https://github.com/brave/browser-laptop/blob/aafa62a373b9bec7b669ced88dd36304410206e8/app/extensions/brave/js/about.js, devServerPort is untrusted input, so it should be validated.

ex: any page can do window.open("chrome-extension://mnojpmjdmbbfmejpflffifhffcmidifd/about-flash.html?devServerPort=foo@test.com/")

doesn't directly cause an issue thanks to CSP, it seems

thanks to Tavis Ormandy for the report
@diracdeltas diracdeltas added this to the 0.12.5dev milestone Oct 13, 2016
@diracdeltas diracdeltas self-assigned this Oct 13, 2016
diracdeltas added a commit that referenced this issue Oct 13, 2016
@diracdeltas
Validated that devServerPort is numeric
d0a361a 
quick fix for #4753

Auditors: @bridiver

Test Plan:
1. open any page
2. open console, enter window.open("chrome-extension://mnojpmjdmbbfmejpflffifhffcmidifd/about-flash.html?devServerPort=foo@test.com/")
3. verify that the opened tab shows about:flash without logging console errors about scripts blocked due to CSP
@bridiver
Copy link
Collaborator

bridiver commented Oct 14, 2016 •
edited
Loading

I couldn't get it to load test.com even when I tried to alter the CSP to allow it. Adding the username password made the entry invalid and it didn't work with just test.com, but calling parseInt on it seems like a good idea anyway

@diracdeltas
Copy link
Member Author

fixed by d0a361a

This was referenced Oct 14, 2016
Closed
Closed
Closed
Closed
This was referenced Oct 16, 2016
Closed
Closed
Closed
Closed
@alexwykoff alexwykoff mentioned this issue Oct 18, 2016
Closed
102 tasks
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Assignees

@diracdeltas diracdeltas

Labels
QA/checked-macOS QA/checked-Win32 QA/checked-Win64 security
Projects
None yet
Milestone
0.12.5dev
Development

No branches or pull requests
5 participants
@bridiver @diracdeltas @alexwykoff @luixxiul @srirambv