Fixed XSS in jsonp-polling.

dreamfrog · Apr 17, 2012 · e98fc7b · e98fc7b
1 parent a4e53a6
commit e98fc7b
Show file tree

Hide file tree

Showing 2 changed files with 6 additions and 4 deletions.
diff --git a/lib/manager.js b/lib/manager.js
@@ -44,7 +44,8 @@ var defaultTransports = exports.defaultTransports = [
  */
 
 var parent = module.parent.exports
-  , protocol = parent.protocol;
+  , protocol = parent.protocol
+  , jsonpolling_re = /^\d+$/;
 
 /**
  * Manager constructor.
@@ -712,7 +713,7 @@ Manager.prototype.handleHandshake = function (data, req, res) {
     };
 
   function writeErr (status, message) {
-    if (data.query.jsonp) {
+    if (data.query.jsonp && jsonpolling_re.test(data.query.jsonp)) {
       res.writeHead(200, { 'Content-Type': 'application/javascript' });
       res.end('io.j[' + data.query.jsonp + '](new Error("' + message + '"));');
     } else {
@@ -751,7 +752,7 @@ Manager.prototype.handleHandshake = function (data, req, res) {
             , self.transports(data).join(',')
           ].join(':');
 
-      if (data.query.jsonp) {
+      if (data.query.jsonp && jsonpolling_re.test(data.query.jsonp)) {
         hs = 'io.j[' + data.query.jsonp + '](' + JSON.stringify(hs) + ');';
         res.writeHead(200, { 'Content-Type': 'application/javascript' });
       } else {

diff --git a/lib/transports/jsonp-polling.js b/lib/transports/jsonp-polling.js
@@ -10,6 +10,7 @@
  */
 
 var HTTPPolling = require('./http-polling');
+var jsonpolling_re = /^\d+$/
 
 /**
  * Export the constructor.
@@ -29,7 +30,7 @@ function JSONPPolling (mng, data, req) {
   this.head = 'io.j[0](';
   this.foot = ');';
 
-  if (data.query.i) {
+  if (data.query.i && jsonpolling_re.test(data.query.i)) {
     this.head = 'io.j[' + data.query.i + '](';
   }
 };