Docs Pro-Tips Whitelist possible flaw? #226

jurkan · 2014-07-11T09:47:18Z

http://raven-js.readthedocs.org/en/latest/tips/index.html

If it's parsed as regex, wouldn't the example whitelist also match yourexample.com, which could be registered by a completely different person?

mattrobenolt · 2014-07-11T14:40:35Z

Yeah, you're right. :) I'll fix.

robinwassen · 2014-08-22T12:30:08Z

I would close this issue as won't fix, because it can't be exploited for anything at all.

And if someone as a script kiddie want to go around the check on his own client, well, just modify the whitelist instead of including stuff from other domains.

mattrobenolt · 2014-08-22T16:19:44Z

Yeah, it doesn't really matter. It has nothing to do with authentication or anything like that. It's all backed by authentication on the server. This whitelist is just to block out noise from errors that you don't care about. --
Sent from Mailbox

On Fri, Aug 22, 2014 at 12:30 PM, Robin Andersson
[email protected] wrote:

I would close this issue as won't fix, because it can't be exploited for anything at all.

And if someone as a script kiddie want to go around the check on your own client, well, just modify the whitelist instead of including stuff from other domains.

Reply to this email directly or view it on GitHub:
#226 (comment)

Fixes getsentry#226

* Simplify context methods to fall back on instance-global context * Fix setContext, add merging hierarchy w/tests * Simplify errorHandler middleware, call next immediately instead of waiting for capture * Deprecate setUser/Tags/ExtraContext * Rename/fix updateContext -> mergeContext

Includes the following fixes: - fix: remote CSS does not get rebuilt properly ([#226](getsentry/rrweb#226)) - fix(snapshot): Set <link> attributes to null for remote CSS ([#227](getsentry/rrweb#227)) - fix(snapshot): Change to ignore all link[rel="modulepreload"] ([#228](getsentry/rrweb#228))

mattrobenolt closed this as completed in fd2dcf8 Dec 1, 2014

matghaleb pushed a commit to matghaleb/raven-js that referenced this issue Sep 9, 2015

Updated regular expression example for tips

86abb91

Fixes getsentry#226

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Docs Pro-Tips Whitelist possible flaw? #226

Docs Pro-Tips Whitelist possible flaw? #226

jurkan commented Jul 11, 2014

mattrobenolt commented Jul 11, 2014

robinwassen commented Aug 22, 2014

mattrobenolt commented Aug 22, 2014

And if someone as a script kiddie want to go around the check on your own client, well, just modify the whitelist instead of including stuff from other domains.

Docs Pro-Tips Whitelist possible flaw? #226

Docs Pro-Tips Whitelist possible flaw? #226

Comments

jurkan commented Jul 11, 2014

mattrobenolt commented Jul 11, 2014

robinwassen commented Aug 22, 2014

mattrobenolt commented Aug 22, 2014

And if someone as a script kiddie want to go around the check on your own client, well, just modify the whitelist instead of including stuff from other domains.