root
/
webpack
mirror of https://github.com/webpack/webpack.git
1
0
Fork 0
Code Issues Actions 1 Packages Projects Releases Wiki Activity

security: fix DOM clobbering in auto public path

This commit is contained in:
Alexander Akait 2024-08-22 15:05:07 +03:00 committed by GitHub
parent 5ac3d7f2cd 9822387362
commit 955e057abc
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
3 changed files with 9 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
lib/runtime/AutoPublicPathRuntimeModule.js
View File

@ -50,7 +50,10 @@ class AutoPublicPathRuntimeModule extends RuntimeModule {
`var document = ${RuntimeGlobals.global}.document;`,
"if (!scriptUrl && document) {",
Template.indent([
"if (document.currentScript)",
// Technically we could use `document.currentScript instanceof window.HTMLScriptElement`,
// but an attacker could try to inject `<script>HTMLScriptElement = HTMLImageElement</script>`
// and use `<img name="currentScript" src="https://attacker.controlled.server/"></img>`
"if (document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT')",
Template.indent("scriptUrl = document.currentScript.src;"),
"if (!scriptUrl) {",
Template.indent([

8
test/Stats.test.js
View File

@ -190,10 +190,10 @@ describe("Stats", () => {
"assets": Array [
Object {
"name": "entryB.js",
"size": 3010,
"size": 3060,
},
],
"assetsSize": 3010,
"assetsSize": 3060,
"auxiliaryAssets": undefined,
"auxiliaryAssetsSize": 0,
"childAssets": undefined,
@ -238,10 +238,10 @@ describe("Stats", () => {
"info": Object {
"javascriptModule": false,
"minimized": true,
"size": 3010,
"size": 3060,
},
"name": "entryB.js",
"size": 3010,
"size": 3060,
"type": "asset",
},
Object {

1
test/helpers/CurrentScript.js
View File

@ -2,6 +2,7 @@ class CurrentScript {
constructor(path = "", type = "text/javascript") {
this.src = `https://test.cases/path/${path}index.js`;
this.type = type;
this.tagName = "script";
}
}