wordpress-develop/src/wp-includes/js/wp-embed.js
Scott Taylor dedff8fd0e WP oEmbed: validate the secret send via postMessage in wp.receiveEmbedMessage. Also, compare window instances.
In the data sent to us from the embedded iframe by postMessage(), the secret value is being used directly in a document.querySelectorAll() call without first being validated or escaped.

In theory, this could lead to some broken embeds.

Props mdawaffe.
Fixes #34831.


git-svn-id: https://develop.svn.wordpress.org/trunk@35761 602fd350-edb4-49c9-b593-d223f7449a82
2015-12-03 20:16:28 +00:00

120 lines
3.0 KiB
JavaScript

(function ( window, document ) {
'use strict';
var supportedBrowser = false,
loaded = false;
if ( document.querySelector ) {
if ( window.addEventListener ) {
supportedBrowser = true;
}
}
window.wp = window.wp || {};
if ( !! window.wp.receiveEmbedMessage ) {
return;
}
window.wp.receiveEmbedMessage = function( e ) {
var data = e.data;
if ( ! ( data.secret || data.message || data.value ) ) {
return;
}
if ( /[^a-zA-Z0-9]/.test( data.secret ) ) {
return;
}
var iframes = document.querySelectorAll( 'iframe[data-secret="' + data.secret + '"]' ),
blockquotes = document.querySelectorAll( 'blockquote[data-secret="' + data.secret + '"]' ),
i, source, height, sourceURL, targetURL;
for ( i = 0; i < blockquotes.length; i++ ) {
blockquotes[ i ].style.display = 'none';
}
for ( i = 0; i < iframes.length; i++ ) {
source = iframes[ i ];
if ( e.source !== source.contentWindow ) {
continue;
}
source.style.display = '';
/* Resize the iframe on request. */
if ( 'height' === data.message ) {
height = parseInt( data.value, 10 );
if ( height > 1000 ) {
height = 1000;
} else if ( ~~height < 200 ) {
height = 200;
}
source.height = height;
}
/* Link to a specific URL on request. */
if ( 'link' === data.message ) {
sourceURL = document.createElement( 'a' );
targetURL = document.createElement( 'a' );
sourceURL.href = source.getAttribute( 'src' );
targetURL.href = data.value;
/* Only continue if link hostname matches iframe's hostname. */
if ( targetURL.host === sourceURL.host ) {
if ( document.activeElement === source ) {
window.top.location.href = data.value;
}
}
}
}
};
function onLoad() {
if ( loaded ) {
return;
}
loaded = true;
var isIE10 = -1 !== navigator.appVersion.indexOf( 'MSIE 10' ),
isIE11 = !!navigator.userAgent.match( /Trident.*rv:11\./ ),
iframes = document.querySelectorAll( 'iframe.wp-embedded-content' ),
blockquotes = document.querySelectorAll( 'blockquote.wp-embedded-content' ),
iframeClone, i, source, secret;
for ( i = 0; i < blockquotes.length; i++ ) {
blockquotes[ i ].style.display = 'none';
}
for ( i = 0; i < iframes.length; i++ ) {
source = iframes[ i ];
source.style.display = '';
if ( source.getAttribute( 'data-secret' ) ) {
continue;
}
/* Add secret to iframe */
secret = Math.random().toString( 36 ).substr( 2, 10 );
source.src += '#?secret=' + secret;
source.setAttribute( 'data-secret', secret );
/* Remove security attribute from iframes in IE10 and IE11. */
if ( ( isIE10 || isIE11 ) ) {
iframeClone = source.cloneNode( true );
iframeClone.removeAttribute( 'security' );
source.parentNode.replaceChild( iframeClone, source );
}
}
}
if ( supportedBrowser ) {
window.addEventListener( 'message', window.wp.receiveEmbedMessage, false );
document.addEventListener( 'DOMContentLoaded', onLoad, false );
window.addEventListener( 'load', onLoad, false );
}
})( window, document );