PrivateCoffee/element-web
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 3

Only allow http and https widget URLs

Browse source
This commit is contained in:
David Baker 2017-07-12 14:16:47 +01:00
parent 918f5abe81
commit a48c7d2364
1 changed files with 8 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

10
src/components/views/elements/AppTile.js
View file

@ -16,13 +16,14 @@ limitations under the License.
'use strict'; 'use strict';
import url from 'url';
import React from 'react'; import React from 'react';
import MatrixClientPeg from '../../../MatrixClientPeg'; import MatrixClientPeg from '../../../MatrixClientPeg';
import ScalarAuthClient from '../../../ScalarAuthClient'; import ScalarAuthClient from '../../../ScalarAuthClient';
import SdkConfig from '../../../SdkConfig'; import SdkConfig from '../../../SdkConfig';
import { _t } from '../../../languageHandler'; import { _t } from '../../../languageHandler';
import url from 'url'; const ALLOWED_APP_URL_SCHEMES = ['https:', 'http:'];
export default React.createClass({ export default React.createClass({
displayName: 'AppTile', displayName: 'AppTile',
@ -126,9 +127,14 @@ export default React.createClass({
// a link to it. // a link to it.
const sandboxFlags = "allow-forms allow-popups allow-popups-to-escape-sandbox "+ const sandboxFlags = "allow-forms allow-popups allow-popups-to-escape-sandbox "+
"allow-same-origin allow-scripts"; "allow-same-origin allow-scripts";
const parsedWidgetUrl = url.parse(this.state.widgetUrl);
let safeWidgetUrl = '';
if (ALLOWED_APP_URL_SCHEMES.indexOf(parsedWidgetUrl.protocol) !== -1) {
safeWidgetUrl = url.format(parsedWidgetUrl);
}
appTileBody = ( appTileBody = (
<div className="mx_AppTileBody"> <div className="mx_AppTileBody">
<iframe ref="appFrame" src={this.state.widgetUrl} allowFullScreen="true" <iframe ref="appFrame" src={safeWidgetUrl} allowFullScreen="true"
sandbox={sandboxFlags} sandbox={sandboxFlags}
></iframe> ></iframe>
</div> </div>