Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Make it embeddable #154

Merged
merged 11 commits into from
Aug 20, 2015
Merged

Make it embeddable #154

Show file tree
Hide file tree
Changes from 5 commits
Commits
Show all changes
11 commits
Select commit Hold shift + click to select a range
143bab5
Merge branch 'master' of https://github.com/alexspeller/ember-twiddle…
Gaurav0 Aug 14, 2015
7153d5b
Restore responsive behavior
Gaurav0 Aug 14, 2015
da5833d
Enable embedding
Gaurav0 Aug 14, 2015
32d117e
Merge branch 'hide-and-show-cols' into embed
Gaurav0 Aug 15, 2015
30aefba
Merge branch 'hide-and-show-cols' into embed
Gaurav0 Aug 16, 2015
0e3664f
Merge branch 'hide-and-show-cols' into embed
Gaurav0 Aug 17, 2015
c6bc07c
Security update
Gaurav0 Aug 17, 2015
9718851
Merge branch 'hide-and-show-cols' into embed
Gaurav0 Aug 18, 2015
a4980b8
Merge branch 'master' into embed
Gaurav0 Aug 18, 2015
3efa00c
Merge branch 'master' into embed
Gaurav0 Aug 20, 2015
9d38726
Merge branch 'master' into embed
Gaurav0 Aug 20, 2015
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 6 additions & 0 deletions app/components/file-menu.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,6 +23,12 @@ export default Ember.Component.extend({
share() {
prompt('Ctrl + C ;-)', window.location.href);
},
embed() {
let src = window.location.href.split("?")[0];
src += "?numColumns=0";
let embedCode = `<iframe width="800" height="600" src="${src}"></iframe>`;
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

the resulting embed values are not correctly sanitized, and could pose a XSS risk.

potential vector:

  1. evil twiddler sends some cleverly crafted href, able to sanitize the src + frame tag in the interpolated string.

I believe this can be safely escaped, or direct DOM api's could be used (which make some issues just impossible):

var iframe = document.createElement("iframe")
iframe.src = src;
iframe.width = 800;
iframe.height = 600;
let embedCode = iframe.outerHTML;

The src still needs to be sanitized, but in the later case the vector is only stuff like javascript: Which is likely tricky to get to via this approach, but we should likely be sure due diligence was done here.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

That's really cool. But we are already using href in Share Twiddle. I'm going to open a PR ASAP and update Ember Twiddle for security reasons.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actually maybe I'm misunderstanding. According to this, using window.location.href is relatively safe, and generally more safe than alternatives: http://stackoverflow.com/questions/24078332/is-it-secure-to-use-window-location-href-directly-without-validation

prompt('Ctrl + C ;-)', embedCode);
},
fork(model) {
this.sendAction('fork', model);
},
Expand Down
5 changes: 4 additions & 1 deletion app/styles/app.scss
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -201,7 +201,10 @@ body {
margin: 0;
margin-left: 0;
z-index: -1;
display: flex;

@media (min-width: $screen-md-min) {
display: flex;
}

.col-md-4 {
flex-grow: 1;
Expand Down
1 change: 1 addition & 0 deletions app/templates/components/file-menu.hbs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,6 +33,7 @@
<li><a {{action 'saveGist' model}} class="test-save-action">Save to Github Gist</a></li>
{{#unless model.isNew}}
<li><a {{action 'share'}}>Share Twiddle</a></li>
<li><a {{action 'embed'}}>Embed Twiddle</a></li>
<li><a {{action 'fork' model}} class="test-fork-action">Fork Twiddle</a></li>
<li><a {{action 'deleteGist' model}} class="test-delete-action">Delete Twiddle</a></li>
{{/unless}}
Expand Down