Changeset 8613 for trunk/src/io

Timestamp:

05/14/07 16:12:19 (20 months ago)

Author:

jburke

Message:

Fixes #3011

Location:

trunk/src/io

Files:

• xip_client.html (modified) (4 diffs)
• xip_server.html (modified) (4 diffs)

trunk/src/io/xip_client.html

@@ -6 +6 @@
         <title></title>
         <meta http-equiv="Content-Type" content="text/html; charset=utf-8"></meta>
-        <script type="text/javascript">
+        <!-- Security protection: uncomment the script tag to enable. -->
+        <!-- script type="text/javascript" -->
         // <!--
         /*
@@ -223 +224 @@
                 //Remove the query param for the IE7 recursive case.
                 xipServerUrl = fixServerUrl(config.server).replace(/(\?|\&)dojo\.fr\=1/, "");
+                
+                //Make sure we don't have a javascript: url, just for good measure.
+                if(xipServerUrl.split(":")[0].match(/javascript/i)){
+                        throw "Invalid server URL";
+                }
+
                 xipUseFrameRecursion = config["fr"];
                 
@@ -235 +242 @@
 
                 var clientUrl = window.location.href.split("#")[0];
-                document.getElementById("iframeHolder").innerHTML = '<iframe src="'
-                        + makeServerUrl("init", 'id=' + xipStateId + '&client=' + encodeURIComponent(clientUrl)
-                        + '&fr=' + xipUseFrameRecursion) + '" id="' + xipStateId + '_frame"></iframe>';
-                        
-                
+                var iframeNode = document.getElementsByTagName("iframe")[0];
+                iframeNode.id = xipStateId + "_frame";
+                iframeNode.src = makeServerUrl("init", 'id=' + xipStateId + '&client='
+                        + encodeURIComponent(clientUrl) + '&fr=' + xipUseFrameRecursion);
         }
 
@@ -257 +263 @@
         internally by dojo.io.XhrIframeProxy.</p>
         
-        <span id="iframeHolder"></span>
+        <iframe src="javascript:false"></iframe>
 </body>
 </html>

trunk/src/io/xip_server.html

@@ -20 +20 @@
         ALL OF YOUR XHR-ENABLED SERVICES ON YOUR SITE. 
         
-        In order for this file to work, you should define a function with the following signature:
+        In order for this file to work, you need to uncomment the script element,
+        and you should define a function with the following signature:
         
         function isAllowedRequest(request){
@@ -46 +47 @@
         See xip_client.html for more info on the xip fragment identifier protocol.      
         -->
-        <script type="text/javascript">
-        // <!--
-        djConfig = {
-                parseWidgets: false,
-                baseScriptUri: "./"
-        }
-        // -->
-        </script>
-        <script type="text/javascript">
+        
+        <!-- Security protection: uncomment the script tag to enable. -->
+        <!-- script type="text/javascript" -->
         // <!--
                 //Core XHR handling taken from Dojo IO code.
@@ -347 +342 @@
                 xipStateId = config.id;
                 xipClientUrl = config.client;
+                
+                //Make sure we don't have a javascript: url, just for good measure.
+                if(xipClientUrl.split(":")[0].match(/javascript/i)){
+                        throw "Invalid client URL";
+                }
+                if(!xipStateId.match(/^XhrIframeProxy[0-9]+$/)){
+                        throw "Invalid state ID";
+                }
+
                 xipUseFrameRecursion = config["fr"];
 
@@ -353 +357 @@
                 if(xipUseFrameRecursion == "true"){
                         var serverUrl = window.location.href.split("#")[0];
-                        document.getElementById("iframeHolder").innerHTML = '<iframe src="'
-                                + makeClientUrl("init", 'id=' + xipStateId + '&server=' + encodeURIComponent(serverUrl)
-                                + '&fr=endpoint') + '" name="' + xipStateId + '_clientEndPoint"></iframe>';
+                        document.getElementById("iframeHolder").innerHTML = '<iframe name="'
+                                + xipStateId + '_clientEndPoint'
+                                + '" src="javascript:false">'
+                                + '</iframe>';
+                        var iframeNode = document.getElementsByTagName("iframe")[0];
+                        iframeNode.src = makeClientUrl("init", 'id=' + xipStateId + '&server='
+                                + encodeURIComponent(serverUrl) + '&fr=endpoint');
                 }else{
                         setClientUrl("loaded");