Changeset 8610

Timestamp:

05/14/07 16:00:18 (20 months ago)

Author:

jburke

Message:

Fixes #3011.

Location:

tags/release-0.4.1/src/io

Files:

• xip_client.html (modified) (5 diffs)
• xip_server.html (modified) (5 diffs)

tags/release-0.4.1/src/io/xip_client.html

@@ -6 +6 @@
         <title></title>
         <meta http-equiv="Content-Type" content="text/html; charset=utf-8"></meta>
-        <script type="text/javascript">
+        <!-- Security protection: uncomment the script tag to enable. -->
+        <!-- script type="text/javascript" -->
         // <!--
         /*
@@ -144 +145 @@
 
                 while((reqData.length - reqIndex) + urlLength > xipUrlLimit){
-                        xipRequestParts.push(reqData.substring(reqIndex, reqIndex + partLength));
-                        reqIndex += partLength;
+                        var part = reqData.substring(reqIndex, reqIndex + partLength);
+                        //Safari will do some extra hex escaping unless we keep the original hex
+                        //escaping complete.
+                        var percentIndex = part.lastIndexOf("%");
+                        if(percentIndex == part.length - 1 || percentIndex == part.length - 2){
+                                part = part.substring(0, percentIndex);
+                        }
+                        xipRequestParts.push(part);
+                        reqIndex += part.length;
                 }
                 xipRequestParts.push(reqData.substring(reqIndex, reqData.length));
@@ -216 +224 @@
                 //Remove the query param for the IE7 recursive case.
                 xipServerUrl = fixServerUrl(config.server).replace(/(\?|\&)dojo\.fr\=1/, "");
+                
+                //Make sure we don't have a javascript: url, just for good measure.
+                if(xipServerUrl.split(":")[0].match(/javascript/i)){
+                        throw "Invalid server URL";
+                }
+
                 xipUseFrameRecursion = config["fr"];
                 
@@ -228 +242 @@
 
                 var clientUrl = window.location.href.split("#")[0];
-                document.getElementById("iframeHolder").innerHTML = '<iframe src="'
-                        + makeServerUrl("init", 'id=' + xipStateId + '&client=' + encodeURIComponent(clientUrl)
-                        + '&fr=' + xipUseFrameRecursion) + '" id="' + xipStateId + '_frame"></iframe>';
-                        
-                
+                var iframeNode = document.getElementsByTagName("iframe")[0];
+                iframeNode.id = xipStateId + "_frame";
+                iframeNode.src = makeServerUrl("init", 'id=' + xipStateId + '&client='
+                        + encodeURIComponent(clientUrl) + '&fr=' + xipUseFrameRecursion);
         }
 
@@ -250 +263 @@
         internally by dojo.io.XhrIframeProxy.</p>
         
-        <span id="iframeHolder"></span>
+        <iframe src="javascript:false"></iframe>
 </body>
 </html>

tags/release-0.4.1/src/io/xip_server.html

@@ -20 +20 @@
         ALL OF YOUR XHR-ENABLED SERVICES ON YOUR SITE. 
         
-        In order for this file to work, you should define a function with the following signature:
+        In order for this file to work, you need to uncomment the script element,
+        and you should define a function with the following signature:
         
         function isAllowedRequest(request){
@@ -46 +47 @@
         See xip_client.html for more info on the xip fragment identifier protocol.      
         -->
-        <script type="text/javascript">
-        // <!--
-        djConfig = {
-                parseWidgets: false,
-                baseScriptUri: "./"
-        }
-        // -->
-        </script>
-        <script type="text/javascript">
+        
+        <!-- Security protection: uncomment the script tag to enable. -->
+        <!-- script type="text/javascript" -->
         // <!--
                 //Core XHR handling taken from Dojo IO code.
@@ -166 +161 @@
 
                 while((resData.length - resIndex) + urlLength > xipUrlLimit){
-                        xipResponseParts.push(resData.substring(resIndex, resIndex + partLength));
-                        resIndex += partLength;
+                        var part = resData.substring(resIndex, resIndex + partLength);
+                        //Safari will do some extra hex escaping unless we keep the original hex
+                        //escaping complete.
+                        var percentIndex = part.lastIndexOf("%");
+                        if(percentIndex == part.length - 1 || percentIndex == part.length - 2){
+                                part = part.substring(0, percentIndex);
+                        }
+                        xipResponseParts.push(part);
+                        resIndex += part.length;
                 }
                 xipResponseParts.push(resData.substring(resIndex, resData.length));
@@ -340 +342 @@
                 xipStateId = config.id;
                 xipClientUrl = config.client;
+                
+                //Make sure we don't have a javascript: url, just for good measure.
+                if(xipClientUrl.split(":")[0].match(/javascript/i)){
+                        throw "Invalid client URL";
+                }
+                if(!xipStateId.match(/^XhrIframeProxy[0-9]+$/)){
+                        throw "Invalid state ID";
+                }
+
                 xipUseFrameRecursion = config["fr"];
 
@@ -346 +357 @@
                 if(xipUseFrameRecursion == "true"){
                         var serverUrl = window.location.href.split("#")[0];
-                        document.getElementById("iframeHolder").innerHTML = '<iframe src="'
-                                + makeClientUrl("init", 'id=' + xipStateId + '&server=' + encodeURIComponent(serverUrl)
-                                + '&fr=endpoint') + '" name="' + xipStateId + '_clientEndPoint"></iframe>';
+                        document.getElementById("iframeHolder").innerHTML = '<iframe name="'
+                                + xipStateId + '_clientEndPoint'
+                                + '" src="javascript:false">'
+                                + '</iframe>';
+                        var iframeNode = document.getElementsByTagName("iframe")[0];
+                        iframeNode.src = makeClientUrl("init", 'id=' + xipStateId + '&server='
+                                + encodeURIComponent(serverUrl) + '&fr=endpoint');
                 }else{
                         setClientUrl("loaded");