fergalmoran/chrometophone
1
0
Fork 0
mirror of https://github.com/fergalmoran/chrometophone.git synced 2025-12-22 09:41:51 +00:00
Code Issues 265 Packages Projects Releases Wiki Activity

Expand XSS regex

Browse Source
This commit is contained in:
burke.davey
2010-08-04 04:54:48 +00:00
parent 1e944b7e94
commit 8b3be565c5
1 changed files with 5 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
appengine/src/com/google/android/chrometophone/server/AuthServlet.java
View File

@@ -54,11 +54,14 @@ public class AuthServlet extends HttpServlet {
// side redirect instead
// Sanitize the extRet URL for XSS protection
String regExChromeOld = "chrome-extension://[a-z]+" +
(signIn ? "/signed_in\\.html" : "/signed_out\\.html"); // TODO: Deprecated 04/08/10
String regExChrome = "chrome-extension://[a-z]+" +
(signIn ? "/signed_in\\.html" : "/signed_out\\.html");
(signIn ? "/help\\.html(#signed_in)?" : "/signed_out\\.html");
String regExFirefox = "http://code\\.google\\.com/p/chrometophone/logo\\?" +
(signIn ? "login" : "logout");
if (extRet.matches(regExChrome) || extRet.matches(regExFirefox)) {
if (extRet.matches(regExChromeOld) || extRet.matches(regExChrome) ||
extRet.matches(regExFirefox)) {
resp.getWriter().println("<meta http-equiv=\"refresh\" content=\"0;url=" + extRet + "\">");
} else {
resp.setStatus(400);