scottjehl/Respond

respond-proxy.html has XSS issue

Opened this issue · 5 comments

zmmbreeze commented

For example: http://yourcdn.com/respond-proxy.html?url=javascript:alert(19890611520);&css=http://yourcdn.com/test.css

Code: https://github.com/scottjehl/Respond/blob/master/cross-domain/respond-proxy.html#L90

matthijsmelissen commented

Confirmed.

ljharb commented

@scottjehl any update on this?

scottjehl commented

So, deprecating the cross-domain proxy is definitely the first thing I'd like to do. A server proxy, while annoying, is likely the better way to handle this situation. I hope you agree.

The proxy has been deprecated in the readme since October, so I think a new point release should remove it.

  • 👍2
lecajer commented

I added the following in respond-proxy.html#L87 in order to have a minimal protection.

// XSS protection
if(domain.toLowerCase().indexOf('javascript') !== -1) {
    domain = null;
}

Not sure if it is possible to pass through.

matthijsmelissen commented

Can we not do whitelisting, i.e. only accept URLs starting with http:// and https://?