actionhero javascript node.js
2016-10-28T00:09:05.982Z
↞ See all posts
Today we released the first-ever security release for ActionHero. Details can be found below:
Previously, the default error responder when a client asked for a static-file which was missing (404) returned the name the of that file
1api.config.errors.fileNotFound = function (connection) { 2 return connection.localize([ 3 "That file is not found (%s)", 4 connection.params.file, 5 ]); 6};
This is dangerous because a malicious actor could request a filename with an executable javascript tag and harm the requester. We now will no longer return the file name:
1api.config.errors.fileNotFound = function (connection) { 2 return connection.localize(["That file is not found"]); 3};
When requesting an action via JSONp, it was possible (though unlikely) that the callback
string you were providing contained malicious javascript which would harm the requester. We will now sanitize the provided callback
in the following way:
1function callbackHtmlEscape(str) { 2 return str 3 .replace(/&/g, "&") 4 .replace(/"/g, """) 5 .replace(/'/g, "'") 6 .replace(/</g, "<") 7 .replace(/>/g, ">") 8 .replace(/\)/g, "") 9 .replace(/\(/g, ""); 10}
This fix has been back-ported to:
A huge thank you to @submitteddenied is earned for reporting these issues and working to fix them.
I write about Technology, Software, and Startups. I use my Product Management, Software Engineering, and Leadership skills to build teams that create world-class digital products.
Get in touch