Skip to content
This repository has been archived by the owner on Apr 20, 2023. It is now read-only.

Commit

Permalink
Fix for CORS vulnerability
Browse files Browse the repository at this point in the history
Summary:
Sites including the raw content of the distribution zip will be susceptible to a CORS attack due to the default cors/index.html file containing an open whitelist regex.
  • Loading branch information
oyvindkinsey committed Apr 8, 2019
1 parent a32ef15 commit 2769b63
Show file tree
Hide file tree
Showing 2 changed files with 2 additions and 2 deletions.
2 changes: 1 addition & 1 deletion build.xml
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@
<property file="build.secret.properties"/>
<property name="project.build.artifactdir" value="./artifacts/"/>
<property name="project.build.publishdir" value="./artifacts/"/>
<property name="project.build.version" value="2.4.20"/>
<property name="project.build.version" value="2.5.00"/>

<!-- Setup classpath for js-build-tools ant tasks -->
<path id="js-build-tasks.classpath">
Expand Down
2 changes: 1 addition & 1 deletion src/cors/index.html
Original file line number Diff line number Diff line change
Expand Up @@ -59,7 +59,7 @@
// this file is by default set up to use Access Control - this means that it will use the headers set by the server to decide whether or not to allow the call to return
var useAccessControl = true;
// always trusted origins, can be exact strings or regular expressions
var alwaysTrustedOrigins = [(/\.?easyxdm\.net/), (/xdm1/)];
var alwaysTrustedOrigins = ["https://consumer.easyxdm.net"];

// instantiate a new easyXDM object which will handle the request
var remote = new easyXDM.Rpc({
Expand Down

0 comments on commit 2769b63

Please sign in to comment.