Changeset 3332 for branches/2.2/jabberit_messenger/jmessenger/js/trophyim.js

Timestamp:

10/06/10 12:00:56 (14 years ago)

Author:

alexandrecorreia

Message:

Ticket #986 - Tratado as mensagens com tags em html para evitar ataques de XSS.

File:

• branches/2.2/jabberit_messenger/jmessenger/js/trophyim.js (modified) (1 diff)

branches/2.2/jabberit_messenger/jmessenger/js/trophyim.js

@@ -851 +851 @@
                         _text = _text.replace(/style/gi,"EVENT_DENY");
 
+                        // Tags HTML
+                        _text = _text.replace(/img /gi,"IMG_DENY ");
+                        
+                        _text = _text.replace(/script /gi,"SCRIPT_DENY ");
+                        
+                        _text = _text.replace(/div /gi,"DIV_DENY ");
+                        
+                        _text = _text.replace(/span /gi,"SPAN_DENY ");
+                        
+                        _text = _text.replace(/iframe /gi,"IFRAME_DENY ");
+                        
                         _message.innerHTML = _text;
                         
                         ////////// BEGIN XSS //////////////////////////////////////////////////
                         // Delete Tags <SCRIPT>
-                        var scripts = _message.getElementsByTagName('script');
+                        var scripts = _message.getElementsByTagName('script_deny');
                         for (var i = 0; i < scripts.length; i++){ _message.removeChild(scripts[i--]); }
                         ////////////////////////////////////////////////////
                         
                         // Delete Tags <IMG>
-                        var _imgSrc = _message.getElementsByTagName('img');
-                        for (var i = 0; i < _imgSrc.length; i++){ _message.removeChild( _imgSrc[i--] ); }
+                        var _imgSrc = _message.getElementsByTagName('img_deny');
+                        for (var i = 0; i < _imgSrc.length; i++){ _imgSrc[i].parentNode.removeChild( _imgSrc[i--] ); }
                         ////////////////////////////////////////////////////
                         
                         // Delete Tags <DIV>
-                        var _Div = _message.getElementsByTagName('div');
-                        for (var i = 0; i < _Div.length; i++){ _message.removeChild( _Div[i--] ); }
+                        var _Div = _message.getElementsByTagName('div_deny');
+                        for (var i = 0; i < _Div.length; i++){ _Div[i].parentNode.removeChild( _Div[i--] ); }
                         ////////////////////////////////////////////////////
                         
                         // Delete Tags <SPAN>
-                        var _Span = _message.getElementsByTagName('span');
-                        for (var i = 0; i < _Span.length; i++){ _message.removeChild( _Span[i--] ); }
+                        var _Span = _message.getElementsByTagName('span_deny');
+                        for (var i = 0; i < _Span.length; i++){ _Span[i].parentNode.removeChild( _Span[i--] ); }
                         ////////////////////////////////////////////////////
 
                         // Delete Tags <IFRAME>
-                        var _Iframe = _message.getElementsByTagName('iframe');
-                        for (var i = 0; i < _Iframe.length; i++){ _message.removeChild( _Iframe[i--] ); }
+                        var _Iframe = _message.getElementsByTagName('iframe_deny');
+                        for (var i = 0; i < _Iframe.length; i++){ _Iframe[i].parentNode.removeChild( _Iframe[i--] ); }
 
                         // Delete Tags <A HREF>
                         var _aHref = _message.getElementsByTagName('a');
-                        for (var i = 0; i < _aHref.length; i++){ _message.removeChild( _aHref[i--] ); }
-
+                        for (var i = 0; i < _aHref.length; i++){ _aHref[i].parentNode.removeChild( _aHref[i--] ); }
                         
                         _message.innerHTML = _message.innerHTML.replace(/^\s+|\s+$|^\n|\n$/g, "");