notes plugin only listens for same-origin postmessages to prevent xss

This commit is contained in:
hakimel 2022-05-12 22:07:48 +02:00
parent 4b6ac46cde
commit 3dade61176
9 changed files with 36 additions and 21 deletions

2
dist/reveal.esm.js vendored

File diff suppressed because one or more lines are too long

File diff suppressed because one or more lines are too long

2
dist/reveal.js vendored

File diff suppressed because one or more lines are too long

2
dist/reveal.js.map vendored

File diff suppressed because one or more lines are too long

View File

@ -4,7 +4,7 @@ export const HORIZONTAL_SLIDES_SELECTOR = '.slides>section';
export const VERTICAL_SLIDES_SELECTOR = '.slides>section.present>section'; export const VERTICAL_SLIDES_SELECTOR = '.slides>section.present>section';
// Methods that may not be invoked via the postMessage API // Methods that may not be invoked via the postMessage API
export const POST_MESSAGE_METHOD_BLACKLIST = /registerPlugin|registerKeyboardShortcut|addKeyBinding|addEventListener/; export const POST_MESSAGE_METHOD_BLACKLIST = /registerPlugin|registerKeyboardShortcut|addKeyBinding|addEventListener|showPreview/;
// Regex for retrieving the fragment style from a class attribute // Regex for retrieving the fragment style from a class attribute
export const FRAGMENT_STYLE_REGEX = /fade-(down|up|right|left|out|in-then-out|in-then-semi-out)|semi-fade-out|current-visible|shrink|grow/; export const FRAGMENT_STYLE_REGEX = /fade-(down|up|right|left|out|in-then-out|in-then-semi-out)|semi-fade-out|current-visible|shrink|grow/;

File diff suppressed because one or more lines are too long

File diff suppressed because one or more lines are too long

View File

@ -151,15 +151,36 @@ const Plugin = () => {
} }
/**
* Check if the given event is from the same origin as the
* current window.
*/
function isSameOriginEvent( event ) {
try {
return window.location.origin === event.source.location.origin;
}
catch ( error ) {
return false;
}
}
function onPostMessage( event ) { function onPostMessage( event ) {
let data = JSON.parse( event.data ); // Only allow same-origin messages
if( data && data.namespace === 'reveal-notes' && data.type === 'connected' ) { // (added 12/5/22 as a XSS safeguard)
clearInterval( connectInterval ); if( isSameOriginEvent( event ) ) {
onConnected();
} let data = JSON.parse( event.data );
else if( data && data.namespace === 'reveal-notes' && data.type === 'call' ) { if( data && data.namespace === 'reveal-notes' && data.type === 'connected' ) {
callRevealApi( data.methodName, data.arguments, data.callId ); clearInterval( connectInterval );
onConnected();
}
else if( data && data.namespace === 'reveal-notes' && data.type === 'call' ) {
callRevealApi( data.methodName, data.arguments, data.callId );
}
} }
} }

View File

@ -380,14 +380,8 @@
var connectionTimeout = setTimeout( function() { var connectionTimeout = setTimeout( function() {
connectionStatus.innerHTML = 'Error connecting to main window.<br>Please try closing and reopening the speaker view.'; connectionStatus.innerHTML = 'Error connecting to main window.<br>Please try closing and reopening the speaker view.';
}, 5000 ); }, 5000 );
;
window.addEventListener( 'message', function( event ) {
// Validate the origin of all messages to avoid parsing messages window.addEventListener( 'message', function( event ) {
// that aren't meant for us
if( window.location.origin !== event.origin ) {
return;
}
clearTimeout( connectionTimeout ); clearTimeout( connectionTimeout );
connectionStatus.style.display = 'none'; connectionStatus.style.display = 'none';