040b101842
This addresses several oversights in assigning security contexts to DOM schema elements found by our security reviewers (thanks!). This also adds some more precise unit tests for the interaction between (Dom)ElementSchemaRegistry and the TemplateParser, and extracts the security specific parts into dom_security_schema.ts. Comparison of (potentially) dangerous property names is done case insensitive, to avoid issues like formAction vs formaction. Part of issue #8511.
67 lines
2.0 KiB
TypeScript
67 lines
2.0 KiB
TypeScript
import {SecurityContext} from '../../core_private';
|
|
|
|
// =================================================================================================
|
|
// =================================================================================================
|
|
// =========== S T O P - S T O P - S T O P - S T O P - S T O P - S T O P ===========
|
|
// =================================================================================================
|
|
// =================================================================================================
|
|
//
|
|
// DO NOT EDIT THIS LIST OF SECURITY SENSITIVE PROPERTIES WITHOUT A SECURITY REVIEW!
|
|
// Reach out to mprobst for details.
|
|
//
|
|
// =================================================================================================
|
|
|
|
/** Map from tagName|propertyName SecurityContext. Properties applying to all tags use '*'. */
|
|
export const SECURITY_SCHEMA: {[k: string]: SecurityContext} = {};
|
|
|
|
function registerContext(ctx: SecurityContext, specs: string[]) {
|
|
for (let spec of specs) SECURITY_SCHEMA[spec.toLowerCase()] = ctx;
|
|
}
|
|
|
|
// Case is insignificant below, all element and attribute names are lower-cased for lookup.
|
|
|
|
registerContext(SecurityContext.HTML, [
|
|
'iframe|srcdoc',
|
|
'*|innerHTML',
|
|
'*|outerHTML',
|
|
]);
|
|
registerContext(SecurityContext.STYLE, ['*|style']);
|
|
// NB: no SCRIPT contexts here, they are never allowed due to the parser stripping them.
|
|
registerContext(SecurityContext.URL, [
|
|
'*|formAction',
|
|
'area|href',
|
|
'area|ping',
|
|
'audio|src',
|
|
'a|href',
|
|
'a|ping',
|
|
'blockquote|cite',
|
|
'body|background',
|
|
'del|cite',
|
|
'form|action',
|
|
'img|src',
|
|
'img|srcset',
|
|
'input|src',
|
|
'ins|cite',
|
|
'q|cite',
|
|
'source|src',
|
|
'source|srcset',
|
|
'video|poster',
|
|
'video|src',
|
|
]);
|
|
registerContext(SecurityContext.RESOURCE_URL, [
|
|
'applet|code',
|
|
'applet|codebase',
|
|
'base|href',
|
|
'embed|src',
|
|
'frame|src',
|
|
'head|profile',
|
|
'html|manifest',
|
|
'iframe|src',
|
|
'link|href',
|
|
'media|src',
|
|
'object|codebase',
|
|
'object|data',
|
|
'script|src',
|
|
'track|src',
|
|
]);
|