zcy
/
svgedit
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Critical security fix preventing cross-domain extensions or extension path via URL 

git-svn-id: http://svg-edit.googlecode.com/svn/trunk@2648 eee81c28-f429-11dd-99c0-75d572ba1ddd
master
Brett Zamir 2014-01-31 07:13:47 +00:00
parent 881d82859b
commit 712c52ed54
1 changed files with 7 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
editor/svg-editor.js
View File

@ -235,12 +235,19 @@
}
if (urldata.extensions) {
if (urldata.extensions.indexOf(':')) { // For security reasons, disallow cross-domain extensions via URL
urldata.extensions = '';
}
urldata.extensions = urldata.extensions.split(',');
}
if (urldata.bkgd_color) {
urldata.bkgd_color = '#' + urldata.bkgd_color;
}
if (urldata.extPath.indexOf(':') > -1) { // For security reasons, disallow cross-domain extension path via URL
delete urldata.extPath;
}
svgEditor.setConfig(urldata);