lbehm/workadventure
1
0
Fork 0
Code Issues Pull requests Releases Activity

Fixed potential injection by switching map container to PHP

Browse source 
Some HTML files were importing iframe_api.js automatically by detecting the referrer document.

While this was done in a safe way (the map container does not use cookies), it is not
a best practice to load a script originating from document.referrer.

This PR solves the issue by using PHP to inject the correct domain name in the HTML files.
This commit is contained in:
David Négrier 2021-11-29 19:05:13 +01:00
parent 233c3d1abe
commit 41fd848fa0
27 changed files with 167 additions and 204 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
deeployer.libsonnet
View file

@ -101,7 +101,10 @@
"host": {
"url": "maps-"+url
},
"ports": [80]
"ports": [80],
"env": {
"FRONT_URL": "https://play-"+url
}
},
"redis": {
"image": "redis:6",

3
docker-compose.single-domain.yaml
View file

@ -92,11 +92,12 @@ services:
- "traefik.http.routers.pusher-ssl.service=pusher"
maps:
image: thecodingmachine/nodejs:12-apache
image: thecodingmachine/php:8.1-v4-apache-node12
environment:
DEBUG_MODE: "$DEBUG_MODE"
HOST: "0.0.0.0"
NODE_ENV: development
FRONT_URL: http://play.workadventure.localhost
#APACHE_DOCUMENT_ROOT: dist/
#APACHE_EXTENSIONS: headers
#APACHE_EXTENSION_HEADERS: 1

3
docker-compose.yaml
View file

@ -96,11 +96,12 @@ services:
- "traefik.http.routers.pusher-ssl.service=pusher"
maps:
image: thecodingmachine/nodejs:12-apache
image: thecodingmachine/php:8.1-v4-apache-node12
environment:
DEBUG_MODE: "$DEBUG_MODE"
HOST: "0.0.0.0"
NODE_ENV: development
FRONT_URL: http://play.workadventure.localhost
#APACHE_DOCUMENT_ROOT: dist/
#APACHE_EXTENSIONS: headers
#APACHE_EXTENSION_HEADERS: 1

2
maps/tests/EmbeddedWebsite/website_in_map_script.json
View file

@ -12,7 +12,7 @@
{
"name":"openWebsite",
"type":"string",
"value":"website_in_map_script.html"
"value":"website_in_map_script.php"
},
{
"name":"openWebsiteAllowApi",

6
maps/tests/EmbeddedWebsite/website_in_map_script.html → maps/tests/EmbeddedWebsite/website_in_map_script.php
View file

@ -1,12 +1,8 @@
<!doctype html>
<html lang="en">
<head>
<script src="<?php echo $_SERVER["FRONT_URL"] ?>/iframe_api.js"></script>
<script>
var script = document.createElement('script');
// Don't do this at home kids! The "document.referrer" part is actually inserting a XSS security.
// We are OK in this precise case because the HTML page is hosted on the "maps" domain that contains only static files.
script.setAttribute('src', document.referrer + 'iframe_api.js');
document.head.appendChild(script);
window.addEventListener('load', () => {
console.log('On load');
WA.onInit().then(() => {

18
maps/tests/Metadata/cowebsiteAllowApi.html
View file

@ -1,18 +0,0 @@
<!doctype html>
<html lang="en">
<head>
<script>
var script = document.createElement('script');
// Don't do this at home kids! The "document.referrer" part is actually inserting a XSS security.
// We are OK in this precise case because the HTML page is hosted on the "maps" domain that contains only static files.
script.setAttribute('src', document.referrer + 'iframe_api.js');
document.head.appendChild(script);
window.addEventListener('load', () => {
WA.chat.sendChatMessage('The iframe opened by a script works !', 'Mr Robot');
})
</script>
</head>
<body>
<p>Website opened by script.</p>
</body>
</html>

2
maps/tests/Metadata/cowebsiteAllowApi.js
View file

@ -1 +1 @@
WA.nav.openCoWebSite("cowebsiteAllowApi.html", true, "");
WA.nav.openCoWebSite("cowebsiteAllowApi.php", true, "");

14
maps/tests/Metadata/cowebsiteAllowApi.php Normal file
View file

@ -0,0 +1,14 @@
<!doctype html>
<html lang="en">
<head>
<script src="<?php echo $_SERVER["FRONT_URL"] ?>/iframe_api.js"></script>
<script>
window.addEventListener('load', () => {
WA.chat.sendChatMessage('The iframe opened by a script works !', 'Mr Robot');
})
</script>
</head>
<body>
<p>Website opened by script.</p>
</body>
</html>

20
maps/tests/Metadata/customIframeMenuApi.html
View file

@ -1,20 +0,0 @@
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8">
<title>API in iframe menu</title>
<script>
var script = document.createElement('script');
// Don't do this at home kids! The "document.referrer" part is actually inserting a XSS security.
// We are OK in this precise case because the HTML page is hosted on the "maps" domain that contains only static files.
script.setAttribute('src', document.referrer + 'iframe_api.js');
document.head.appendChild(script);
window.addEventListener('load', () => {
WA.chat.sendChatMessage('The iframe opened by a script works !', 'Mr Robot');
})
</script>
</head>
<body style="text-align: center">
<p style="color: whitesmoke">This is an iframe in a custom menu.</p>
</body>
</html>

16
maps/tests/Metadata/customIframeMenuApi.php Normal file
View file

@ -0,0 +1,16 @@
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8">
<title>API in iframe menu</title>
<script src="<?php echo $_SERVER["FRONT_URL"] ?>/iframe_api.js"></script>
<script>
window.addEventListener('load', () => {
WA.chat.sendChatMessage('The iframe opened by a script works !', 'Mr Robot');
})
</script>
</head>
<body style="text-align: center">
<p style="color: whitesmoke">This is an iframe in a custom menu.</p>
</body>
</html>

18
maps/tests/Metadata/customMenu.html
View file

@ -1,18 +0,0 @@
<!doctype html>
<html lang="en">
<head>
<script>
var script = document.createElement('script');
// Don't do this at home kids! The "document.referrer" part is actually inserting a XSS security.
// We are OK in this precise case because the HTML page is hosted on the "maps" domain that contains only static files.
script.setAttribute('src', document.referrer + 'iframe_api.js');
document.head.appendChild(script);
window.addEventListener('load', () => {
WA.ui.registerMenuCommand('test', 'customIframeMenu.html', {autoClose: true});
})
</script>
</head>
<body>
<p>Add a custom menu</p>
</body>
</html>

2
maps/tests/Metadata/customMenu.js
View file

@ -7,7 +7,7 @@ WA.ui.registerMenuCommand('custom callback menu', () => {
WA.ui.registerMenuCommand('custom iframe menu', {iframe: 'customIframeMenu.html'});
WA.room.onEnterZone('iframeMenu', () => {
menuIframeApi = WA.ui.registerMenuCommand('IFRAME USE API', {iframe: 'customIframeMenuApi.html', allowApi: true});
menuIframeApi = WA.ui.registerMenuCommand('IFRAME USE API', {iframe: 'customIframeMenuApi.php', allowApi: true});
})
WA.room.onLeaveZone('iframeMenu', () => {

2
maps/tests/Metadata/customMenu.json
View file

@ -54,7 +54,7 @@
{
"name":"openWebsite",
"type":"string",
"value":"customMenu.html"
"value":"customMenu.php"
},
{
"name":"openWebsiteAllowApi",

14
maps/tests/Metadata/customMenu.php Normal file
View file

@ -0,0 +1,14 @@
<!doctype html>
<html lang="en">
<head>
<script src="<?php echo $_SERVER["FRONT_URL"] ?>/iframe_api.js"></script>
<script>
window.addEventListener('load', () => {
WA.ui.registerMenuCommand('test', 'customIframeMenu.html', {autoClose: true});
})
</script>
</head>
<body>
<p>Add a custom menu</p>
</body>
</html>

18
maps/tests/Metadata/playerMove.html
View file

@ -1,18 +0,0 @@
<!doctype html>
<html lang="en">
<head>
<script>
var script = document.createElement('script');
// Don't do this at home kids! The "document.referrer" part is actually inserting a XSS security.
// We are OK in this precise case because the HTML page is hosted on the "maps" domain that contains only static files.
script.setAttribute('src', document.referrer + 'iframe_api.js');
document.head.appendChild(script);
window.addEventListener('load', () => {
WA.player.onPlayerMove(console.log);
})
</script>
</head>
<body>
<p>Log in the console the movement of the current player in the zone of the iframe</p>
</body>
</html>

2
maps/tests/Metadata/playerMove.json
View file

@ -36,7 +36,7 @@
{
"name":"openWebsite",
"type":"string",
"value":"playerMove.html"
"value":"playerMove.php"
},
{
"name":"openWebsiteAllowApi",

14
maps/tests/Metadata/playerMove.php Normal file
View file

@ -0,0 +1,14 @@
<!doctype html>
<html lang="en">
<head>
<script src="<?php echo $_SERVER["FRONT_URL"] ?>/iframe_api.js"></script>
<script>
window.addEventListener('load', () => {
WA.player.onPlayerMove(console.log);
})
</script>
</head>
<body>
<p>Log in the console the movement of the current player in the zone of the iframe</p>
</body>
</html>

2
maps/tests/Metadata/setProperty.json
View file

@ -36,7 +36,7 @@
{
"name":"openWebsite",
"type":"string",
"value":"setProperty.html"
"value":"setProperty.php"
},
{
"name":"openWebsiteAllowApi",

6
maps/tests/Metadata/setProperty.html → maps/tests/Metadata/setProperty.php
View file

@ -1,12 +1,8 @@
<!doctype html>
<html lang="en">
<head>
<script src="<?php echo $_SERVER["FRONT_URL"] ?>/iframe_api.js"></script>
<script>
var script = document.createElement('script');
// Don't do this at home kids! The "document.referrer" part is actually inserting a XSS security.
// We are OK in this precise case because the HTML page is hosted on the "maps" domain that contains only static files.
script.setAttribute('src', document.referrer + 'iframe_api.js');
document.head.appendChild(script);
window.addEventListener('load', () => {
WA.room.setProperty('iframeTest', 'openWebsite', 'https://www.wikipedia.org/');
WA.room.setProperty('metadata', 'openWebsite', 'https://www.wikipedia.org/');

6
maps/tests/Metadata/setTiles.html
View file

@ -1,12 +1,8 @@
<!doctype html>
<html lang="en">
<head>
<script src="<?php echo $_SERVER["FRONT_URL"] ?>/iframe_api.js"></script>
<script>
var script = document.createElement('script');
// Don't do this at home kids! The "document.referrer" part is actually inserting a XSS security.
// We are OK in this precise case because the HTML page is hosted on the "maps" domain that contains only static files.
script.setAttribute('src', document.referrer + 'iframe_api.js');
document.head.appendChild(script);
window.addEventListener('load', () => {
WA.room.setTiles([

2
maps/tests/Metadata/setTiles.json
View file

@ -43,7 +43,7 @@
{
"name":"openWebsite",
"type":"string",
"value":"setTiles.html"
"value":"setTiles.php"
},
{
"name":"openWebsiteAllowApi",

6
maps/tests/Metadata/showHideLayer.html
View file

@ -1,12 +1,8 @@
<!doctype html>
<html lang="en">
<head>
<script src="<?php echo $_SERVER["FRONT_URL"] ?>/iframe_api.js"></script>
<script>
var script = document.createElement('script');
// Don't do this at home kids! The "document.referrer" part is actually inserting a XSS security.
// We are OK in this precise case because the HTML page is hosted on the "maps" domain that contains only static files.
script.setAttribute('src', document.referrer + 'iframe_api.js');
document.head.appendChild(script);
window.addEventListener('load', () => {
document.getElementById('show/hideLayer').onclick = () => {
if (document.getElementById('show/hideLayer').checked) {

2
maps/tests/Metadata/showHideLayer.json
View file

@ -48,7 +48,7 @@
{
"name":"openWebsite",
"type":"string",
"value":"showHideLayer.html"
"value":"showHideLayer.php"
},
{
"name":"openWebsiteAllowApi",

2
maps/tests/Variables/shared_variables.json
View file

@ -12,7 +12,7 @@
{
"name":"openWebsite",
"type":"string",
"value":"shared_variables.html"
"value":"shared_variables.php"
},
{
"name":"openWebsiteAllowApi",

6
maps/tests/Variables/shared_variables.html → maps/tests/Variables/shared_variables.php
View file

@ -1,12 +1,8 @@
<!doctype html>
<html lang="en">
<head>
<script src="<?php echo $_SERVER["FRONT_URL"] ?>/iframe_api.js"></script>
<script>
var script = document.createElement('script');
// Don't do this at home kids! The "document.referrer" part is actually inserting a XSS security.
// We are OK in this precise case because the HTML page is hosted on the "maps" domain that contains only static files.
script.setAttribute('src', document.referrer + 'iframe_api.js');
document.head.appendChild(script);
window.addEventListener('load', () => {
console.log('On load');
WA.onInit().then(() => {

8
maps/tests/iframe.html → maps/tests/iframe.php
View file

@ -1,13 +1,7 @@
<!doctype html>
<html lang="en">
<head>
<script>
var script = document.createElement('script');
// Don't do this at home kids! The "document.referrer" part is actually inserting a XSS security.
// We are OK in this precise case because the HTML page is hosted on the "maps" domain that contains only static files.
script.setAttribute('src', document.referrer + 'iframe_api.js');
document.head.appendChild(script);
</script>
<script src="<?php echo $_SERVER["FRONT_URL"] ?>/iframe_api.js"></script>
</head>
<body>
<button id="sendchat">Send chat message</button>

2
maps/tests/iframe_api.json
View file

@ -43,7 +43,7 @@
{
"name":"openWebsite",
"type":"string",
"value":"iframe.html"
"value":"iframe.php"
},
{
"name":"openWebsiteAllowApi",