random-mirrors/cosmos-explorer
1
0
Fork 0
mirror of https://github.com/Azure/cosmos-explorer.git synced 2025-02-16 17:25:58 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fix Parent Origin Regex (#1239)

Browse Source 
Not all regex are escaped properly
This commit is contained in:
Armando Trejo Oliver 2022-03-25 12:59:18 -07:00 committed by GitHub
parent d1587ef033
commit 496f596f38
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
3 changed files with 31411 additions and 556 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

31921
package-lock.json generated
View File

File diff suppressed because it is too large Load Diff

4
src/ConfigContext.ts
View File

@ -52,10 +52,10 @@ let configContext: Readonly<ConfigContext> = {
allowedParentFrameOrigins: [ allowedParentFrameOrigins: [
`^https:\\/\\/cosmos\\.azure\\.(com|cn|us)$`, `^https:\\/\\/cosmos\\.azure\\.(com|cn|us)$`,
`^https:\\/\\/[\\.\\w]*portal\\.azure\\.(com|cn|us)$`, `^https:\\/\\/[\\.\\w]*portal\\.azure\\.(com|cn|us)$`,
`^https:\\/\\/[\\.\\w]*portal\\.microsoftazure.de$`, `^https:\\/\\/[\\.\\w]*portal\\.microsoftazure\\.de$`,
`^https:\\/\\/[\\.\\w]*ext\\.azure\\.(com|cn|us)$`, `^https:\\/\\/[\\.\\w]*ext\\.azure\\.(com|cn|us)$`,
`^https:\\/\\/[\\.\\w]*\\.ext\\.microsoftazure\\.de$`, `^https:\\/\\/[\\.\\w]*\\.ext\\.microsoftazure\\.de$`,
`^https://cosmos-db-dataexplorer-germanycentral.azurewebsites.de$`, `^https:\\/\\/cosmos-db-dataexplorer-germanycentral\\.azurewebsites\\.de$`,
], // Webpack injects this at build time ], // Webpack injects this at build time
gitSha: process.env.GIT_SHA, gitSha: process.env.GIT_SHA,
hostedExplorerURL: "https://cosmos.azure.com/", hostedExplorerURL: "https://cosmos.azure.com/",

42
src/Utils/MessageValidation.test.ts
View File

@ -2,26 +2,28 @@ import { isInvalidParentFrameOrigin, isReadyMessage } from "./MessageValidation"
describe("isInvalidParentFrameOrigin", () => { describe("isInvalidParentFrameOrigin", () => {
test.each` test.each`
domain | expected domain | expected
${"https://cosmos.azure.com"} | ${false} ${"https://cosmos.azure.com"} | ${false}
${"https://cosmos.azure.us"} | ${false} ${"https://cosmos.azure.us"} | ${false}
${"https://cosmos.azure.cn"} | ${false} ${"https://cosmos.azure.cn"} | ${false}
${"https://portal.azure.com"} | ${false} ${"https://portal.azure.com"} | ${false}
${"https://portal.azure.us"} | ${false} ${"https://portal.azure.us"} | ${false}
${"https://portal.azure.cn"} | ${false} ${"https://portal.azure.cn"} | ${false}
${"https://portal.microsoftazure.de"} | ${false} ${"https://portal.microsoftazure.de"} | ${false}
${"https://subdomain.portal.azure.com"} | ${false} ${"https://subdomain.portal.azure.com"} | ${false}
${"https://subdomain.portal.azure.us"} | ${false} ${"https://subdomain.portal.azure.us"} | ${false}
${"https://subdomain.portal.azure.cn"} | ${false} ${"https://subdomain.portal.azure.cn"} | ${false}
${"https://main.documentdb.ext.azure.com"} | ${false} ${"https://main.documentdb.ext.azure.com"} | ${false}
${"https://main.documentdb.ext.azure.us"} | ${false} ${"https://main.documentdb.ext.azure.us"} | ${false}
${"https://main.documentdb.ext.azure.cn"} | ${false} ${"https://main.documentdb.ext.azure.cn"} | ${false}
${"https://main.documentdb.ext.microsoftazure.de"} | ${false} ${"https://cosmos-db-dataexplorer-germanycentral.azurewebsites.de"} | ${false}
${"https://random.domain"} | ${true} ${"https://main.documentdb.ext.microsoftazure.de"} | ${false}
${"https://malicious.cloudapp.azure.com"} | ${true} ${"https://random.domain"} | ${true}
${"https://malicious.germanycentral.cloudapp.microsoftazure.de"} | ${true} ${"https://malicious.cloudapp.azure.com"} | ${true}
${"https://maliciousazure.com"} | ${true} ${"https://malicious.germanycentral.cloudapp.microsoftazure.de"} | ${true}
${"https://maliciousportalsazure.com"} | ${true} ${"https://maliciousazure.com"} | ${true}
${"https://maliciousportalsazure.com"} | ${true}
${"https://cosmos-db-dataexplorer-germanycentralAazurewebsites.de"} | ${true}
`("returns $expected when called with $domain", ({ domain, expected }) => { `("returns $expected when called with $domain", ({ domain, expected }) => {
expect(isInvalidParentFrameOrigin({ origin: domain } as MessageEvent)).toBe(expected); expect(isInvalidParentFrameOrigin({ origin: domain } as MessageEvent)).toBe(expected);
}); });