Re: Security in gwt application.

Thomas,

This piece of code is in nocache.js

function getDirectoryOfFile(path){

      var hashIndex = path.lastIndexOf('#');

      if (hashIndex == -1) {

        hashIndex = path.length;

      }

      var queryIndex = path.indexOf('?');

      if (queryIndex == -1) {

        queryIndex = path.length;

      }

      var slashIndex = path.lastIndexOf('/', Math.min(queryIndex, hashIndex));

      return slashIndex >= 0?path.substring(0, slashIndex + 1):'';

}

The "path" parameter to this function comes from document.location.href attribute.

 

This function is basically finding the last index of "/" in the browser address bar ignoring what is there after "?" and "#".

From what I know DOM based XSS can occur by injecting scripts after "?" or "#" like this

 

Server can sanitize this script because the value of the name attribute is sent to the server

http://domain.com/index.html?name=<script>MALICIOUS_CODE</script>

OR

 

Server cannot sanitize this script because the fragment after "#" is never sent to the server and runs on the browser itself

http://domain.com/index.html#name=<script>MALICIOUS_CODE</script>

nochache.js also has the following code

base = getDirectoryOfFile(document.location.href);

document.write('<script language="javascript" src="' + base + 'scripts/xyz.js"><\/script>');

 Our security analysis tool complains that this is an XSS issue since base is not a compile time constant.

 

On Wed, Apr 17, 2013 at 6:08 PM, Thomas Broyer <t.broyer@gmail.com> wrote:

On Wednesday, April 17, 2013 3:20:09 PM UTC+2, Shashank Raj Holavanalli wrote:

Thomas,

I am using GWT 2.0.3 and this is being generated in the *.nocache.js.

Come on, 2.0.3 is 3 damn years old!

 

Is there any solution to this ? This clearly seems like an XSS vulnerability to me. Have you fixed this in the later version ? If yes then which one ?

There's been a few security fixes in latest versions (though not related to this one).

AFAICT, assuming this is from computeBaseUrl(), this code will almost never be called (it depends how you load the nocache.js), so there should be no vulnerability in practice.

It'd help if you could give more info as to which code exactly you're talking about (compile with -style PRETTY so the JS won't be obfuscated).

--
You received this message because you are subscribed to a topic in the Google Groups "Google Web Toolkit" group.
To unsubscribe from this topic, visit https://groups.google.com/d/topic/google-web-toolkit/WKcB-pDtfgA/unsubscribe?hl=en.
To unsubscribe from this group and all its topics, send an email to google-web-toolkit+unsubscribe@googlegroups.com.
To post to this group, send email to google-web-toolkit@googlegroups.com.
Visit this group at http://groups.google.com/group/google-web-toolkit?hl=en.
For more options, visit https://groups.google.com/groups/opt_out.
 
 

--

Shashank Raj Holavanalli

Software Engineer

NetApp New England

www.crackeasily.com

--
You received this message because you are subscribed to the Google Groups "Google Web Toolkit" group.
To unsubscribe from this group and stop receiving emails from it, send an email to google-web-toolkit+unsubscribe@googlegroups.com.
To post to this group, send email to google-web-toolkit@googlegroups.com.
Visit this group at http://groups.google.com/group/google-web-toolkit?hl=en.
For more options, visit https://groups.google.com/groups/opt_out.