From 5c84b3a7d475f7c62043c7b3417f057a312fb08d Mon Sep 17 00:00:00 2001 From: Jordi Bunster Date: Tue, 25 Aug 2020 22:48:58 -0700 Subject: [PATCH] Allow 'platform' only to be overriden (#167) ConfigContext defines all kinds of URLs and what not, I'm not sure about the security implications of allowing all this stuff to be modifiable by just anyone. --- src/ConfigContext.ts | 18 +++++++++++++----- 1 file changed, 13 insertions(+), 5 deletions(-) diff --git a/src/ConfigContext.ts b/src/ConfigContext.ts index da4abb0aa..afa40f310 100644 --- a/src/ConfigContext.ts +++ b/src/ConfigContext.ts @@ -80,12 +80,20 @@ export async function initializeConfiguration(): Promise { console.error(error); } } - // Allow override of any config value with URL query parameters + // Allow override of platform value with URL query parameter const params = new URLSearchParams(window.location.search); - params.forEach((value, key) => { - // eslint-disable-next-line @typescript-eslint/no-explicit-any - (configContext as any)[key] = value; - }); + if (params.has("platform")) { + const platform = params.get("platform"); + switch (platform) { + default: + console.log("Invalid platform query parameter given, ignoring"); + break; + case Platform.Portal: + case Platform.Hosted: + case Platform.Emulator: + updateConfigContext({ platform }); + } + } } catch (error) { console.log("No configuration file found using defaults"); }