Changeset 38890

Timestamp:

10/24/2016 08:06:06 PM (8 years ago)

Author:

westonruter

Message:

Customize: Harden url matching to account for varying ports and ensuring matching base pathname for allowed urls

Fixes #38409.

Location:

trunk/src

Files:

• wp-admin/js/customize-controls.js (modified) (2 diffs)
• wp-includes/js/customize-base.js (modified) (1 diff)
• wp-includes/js/customize-preview.js (modified) (6 diffs)

trunk/src/wp-admin/js/customize-controls.js

@@ -4041 +4041 @@
 
             previewer.add( 'previewUrl', params.previewUrl ).setter( function( to ) {
-                var result, urlParser, newPreviewUrl, schemeMatchingPreviewUrl, queryParams;
+                var result = null, urlParser, queryParams, parsedAllowedUrl, parsedCandidateUrls = [];
                 urlParser = document.createElement( 'a' );
                 urlParser.href = to;
@@ -4063 +4063 @@
                 }
 
-                newPreviewUrl = urlParser.href;
-                urlParser.protocol = previewer.scheme.get() + ':';
-                schemeMatchingPreviewUrl = urlParser.href;
+                parsedCandidateUrls.push( urlParser );
+
+                // Prepend list with URL that matches the scheme/protocol of the iframe.
+                if ( previewer.scheme.get() + ':' !== urlParser.protocol ) {
+                    urlParser = document.createElement( 'a' );
+                    urlParser.href = parsedCandidateUrls[0].href;
+                    urlParser.protocol = previewer.scheme.get() + ':';
+                    parsedCandidateUrls.unshift( urlParser );
+                }
 
                 // Attempt to match the URL to the control frame's scheme
                 // and check if it's allowed. If not, try the original URL.
-                $.each( [ schemeMatchingPreviewUrl, newPreviewUrl ], function( i, url ) {
-                    $.each( previewer.allowedUrls, function( i, allowed ) {
-                        var path;
-
-                        allowed = allowed.replace( /\/+$/, '' );
-                        path = url.replace( allowed, '' );
-
-                        if ( 0 === url.indexOf( allowed ) && /^([/#?]|$)/.test( path ) ) {
-                            result = url;
-                            return false;
+                parsedAllowedUrl = document.createElement( 'a' );
+                _.find( parsedCandidateUrls, function( parsedCandidateUrl ) {
+                    return ! _.isUndefined( _.find( previewer.allowedUrls, function( allowedUrl ) {
+                        parsedAllowedUrl.href = allowedUrl;
+                        if ( urlParser.protocol === parsedAllowedUrl.protocol && urlParser.host === parsedAllowedUrl.host && 0 === parsedAllowedUrl.pathname.indexOf( urlParser.pathname ) ) {
+                            result = parsedCandidateUrl.href;
+                            return true;
                         }
-                    });
-                    if ( result ) {
-                        return false;
-                    }
-                });
-
-                // If we found a matching result, return it. If not, bail.
-                return result ? result : null;
+                    } ) );
+                } );
+
+                return result;
             });
 

trunk/src/wp-includes/js/customize-base.js

@@ -655 +655 @@
                 var urlParser = document.createElement( 'a' );
                 urlParser.href = to;
-                return urlParser.protocol + '//' + urlParser.hostname;
+                // Port stripping needed by IE since it adds to host but not to event.origin.
+                return urlParser.protocol + '//' + urlParser.host.replace( /:80$/, '' );
             });
 

trunk/src/wp-includes/js/customize-preview.js

@@ -276 +276 @@
      * @param {string} element.search Query string.
      * @param {string} element.pathname Path.
-     * @param {string} element.hostname Hostname.
+     * @param {string} element.host Host.
      * @param {object} [options]
      * @param {object} [options.allowAdminAjax=false] Allow admin-ajax.php requests.
@@ -282 +282 @@
      */
     api.isLinkPreviewable = function isLinkPreviewable( element, options ) {
-        var hasMatchingHost, urlParser, args;
+        var matchesAllowedUrl, parsedAllowedUrl, args;
 
         args = _.extend( {}, { allowAdminAjax: false }, options || {} );
@@ -295 +295 @@
         }
 
-        urlParser = document.createElement( 'a' );
-        hasMatchingHost = ! _.isUndefined( _.find( api.settings.url.allowed, function( allowedUrl ) {
-            urlParser.href = allowedUrl;
-            if ( urlParser.hostname === element.hostname && urlParser.protocol === element.protocol ) {
-                return true;
-            }
-            return false;
+        parsedAllowedUrl = document.createElement( 'a' );
+        matchesAllowedUrl = ! _.isUndefined( _.find( api.settings.url.allowed, function( allowedUrl ) {
+            parsedAllowedUrl.href = allowedUrl;
+            return parsedAllowedUrl.protocol === element.protocol && parsedAllowedUrl.host === element.host && 0 === element.pathname.indexOf( parsedAllowedUrl.pathname );
         } ) );
-        if ( ! hasMatchingHost ) {
+        if ( ! matchesAllowedUrl ) {
             return false;
         }
@@ -332 +329 @@
      *
      * @param {HTMLAnchorElement|HTMLAreaElement} element Link element.
-     * @param {object} element.search Query string.
+     * @param {string} element.search Query string.
+     * @param {string} element.host Host.
+     * @param {string} element.protocol Protocol.
      * @returns {void}
      */
@@ -349 +348 @@
 
         // Make sure links in preview use HTTPS if parent frame uses HTTPS.
-        if ( 'https' === api.preview.scheme.get() && 'http:' === element.protocol && -1 !== api.settings.url.allowedHosts.indexOf( element.hostname ) ) {
+        if ( 'https' === api.preview.scheme.get() && 'http:' === element.protocol && -1 !== api.settings.url.allowedHosts.indexOf( element.host ) ) {
             element.protocol = 'https:';
         }
@@ -497 +496 @@
 
         // Make sure forms in preview use HTTPS if parent frame uses HTTPS.
-        if ( 'https' === api.preview.scheme.get() && 'http:' === urlParser.protocol && -1 !== api.settings.url.allowedHosts.indexOf( urlParser.hostname ) ) {
+        if ( 'https' === api.preview.scheme.get() && 'http:' === urlParser.protocol && -1 !== api.settings.url.allowedHosts.indexOf( urlParser.host ) ) {
             urlParser.protocol = 'https:';
             form.action = urlParser.href;