Changeset 3325 for branches/2.2/jabberit_messenger/jmessenger/js/trophyim.js

Timestamp:

10/05/10 16:08:15 (14 years ago)

Author:

alexandrecorreia

Message:

Ticket #986 - Tratado as mensagens com tags em html para evitar ataques de XSS.

File:

• branches/2.2/jabberit_messenger/jmessenger/js/trophyim.js (modified) (1 diff)

branches/2.2/jabberit_messenger/jmessenger/js/trophyim.js

@@ -810 +810 @@
 
                         // Get Message
-                        var _message = document.createElement("div");
-                        _message.innerHTML = Strophe.getText(elems[0]);
-                        
+                        var _message    = document.createElement("div");
+                        var _text               = Strophe.getText( elems[0] );
+                        
+                        // Events Javascript
+                        _text = _text.replace(/onblur/gi,"EVENT_DENY");
+                        
+                        _text = _text.replace(/onchange/gi,"EVENT_DENY");
+                        
+                        _text = _text.replace(/onclick/gi,"EVENT_DENY");
+                        
+                        _text = _text.replace(/ondblclick/gi,"EVENT_DENY");
+                        
+                        _text = _text.replace(/onerror/gi,"EVENT_DENY");
+                        
+                        _text = _text.replace(/onfocus/gi,"EVENT_DENY");
+                        
+                        _text = _text.replace(/onkeydown/gi,"EVENT_DENY");
+                        
+                        _text = _text.replace(/onkeypress/gi,"EVENT_DENY");
+                        
+                        _text = _text.replace(/onkeyup/gi,"EVENT_DENY");
+                        
+                        _text = _text.replace(/onmousedown/gi,"EVENT_DENY");
+                        
+                        _text = _text.replace(/onmousemove/gi,"EVENT_DENY");
+                        
+                        _text = _text.replace(/onmouseout/gi,"EVENT_DENY");
+                        
+                        _text = _text.replace(/onmouseover/gi,"EVENT_DENY");
+                        
+                        _text = _text.replace(/onmouseup/gi,"EVENT_DENY");
+                        
+                        _text = _text.replace(/onresize/gi,"EVENT_DENY");
+                        
+                        _text = _text.replace(/onselect/gi,"EVENT_DENY");
+                        
+                        _text = _text.replace(/onunload/gi,"EVENT_DENY");
+                        
+                        // Events CSS
+                        _text = _text.replace(/style/gi,"EVENT_DENY");
+
+                        _message.innerHTML = _text;
+                        
+                        ////////// BEGIN XSS //////////////////////////////////////////////////
                         // Delete Tags <SCRIPT>
                         var scripts = _message.getElementsByTagName('script');
-                        
-                        for (var i = 0; i < scripts.length; i++) 
-                                _message.removeChild(scripts[i--]);
+                        for (var i = 0; i < scripts.length; i++){ _message.removeChild(scripts[i--]); }
+                        ////////////////////////////////////////////////////
                         
                         // Delete Tags <IMG>
                         var _imgSrc = _message.getElementsByTagName('img');
-                        
-                        for (var i = 0; i < _imgSrc.length; i++) 
-                                _message.removeChild( _imgSrc[i--] );
-
+                        for (var i = 0; i < _imgSrc.length; i++){ _message.removeChild( _imgSrc[i--] ); }
+                        ////////////////////////////////////////////////////
+                        
+                        // Delete Tags <DIV>
+                        var _Div = _message.getElementsByTagName('div');
+                        for (var i = 0; i < _Div.length; i++){ _message.removeChild( _Div[i--] ); }
+                        ////////////////////////////////////////////////////
+                        
+                        // Delete Tags <SPAN>
+                        var _Span = _message.getElementsByTagName('span');
+                        for (var i = 0; i < _Span.length; i++){ _message.removeChild( _Span[i--] ); }
+                        ////////////////////////////////////////////////////
+
+                        // Delete Tags <IFRAME>
+                        var _Iframe = _message.getElementsByTagName('iframe');
+                        for (var i = 0; i < _Iframe.length; i++){ _message.removeChild( _Iframe[i--] ); }
+
+                        // Delete Tags <A HREF>
+                        var _aHref = _message.getElementsByTagName('a');
+                        for (var i = 0; i < _aHref.length; i++){ _message.removeChild( _aHref[i--] ); }
+
+                        
                         _message.innerHTML = _message.innerHTML.replace(/^\s+|\s+$|^\n|\n$/g, "");
+                        ////////// END XSS //////////////////////////////////////////////////
                         
                         // Get Smiles