Skip to content

prepend jsonp callbacks with a comment to prevent the rosetta-flash vulnerability - #1766

Merged
hueniverse merged 1 commit into
hapijs:masterfrom
patrickkettner:rosetta-flash
Jul 14, 2014
Merged

hueniverse merged 1 commit into
hapijs:masterfrom
patrickkettner:rosetta-flash

Conversation

@patrickkettner

Copy link
Copy Markdown
Contributor

background

tl:dr - someone created a alphanum only swf converter, which means that they can in theory use it as a callback at a JSONP endpoint, and as a result, send data across domains.

Prepending callbacks with an empty inline comment breaks the flash parser, and prevents the issue. This is how google, facebook, github, et al are handeling it.

CVE-2014-4671A

@hueniverse hueniverse added this to the 6.1.0 milestone Jul 14, 2014
@hueniverse hueniverse self-assigned this Jul 14, 2014
hueniverse pushed a commit that referenced this pull request Jul 14, 2014
prepend jsonp callbacks with a comment to prevent the rosetta-flash vulnerability
@hueniverse
hueniverse merged commit d47f57a into hapijs:master Jul 14, 2014
@patrickkettner
patrickkettner deleted the rosetta-flash branch July 14, 2014 21:15
hueniverse pushed a commit that referenced this pull request Jul 14, 2014
Comment thread test/response.js

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

JSON-P responses should also get an X-Content-Type-Options: nosniff header, just in case. This would have prevented the Rosetta Flash vulnerability too, in modern browsers, and it might prevent similar attacks that bypass the /**/-based protection in the future.

See https://gist.github.com/mathiasbynens/5547352 for an example in PHP (LOLWAT, I know).

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

That header can be added by setting

{
  security: {
    noSniff: true
  }
}

in your server options.

Or with several other security related headers by just setting { security: true }.

Just to remind people that this functionality does exist.

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Do you think it would make sense to enable this header by default for JSON-P responses?

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

For a while I think @hueniverse was debating enabling all of the security headers by default. I'm not sure how he feels about this.

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'll submit another PR and we can find out :]

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

PR

@lock lock Bot locked as resolved and limited conversation to collaborators Jan 9, 2020
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Labels

security Issue with security impact

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants