We read every piece of feedback, and take your input very seriously.
To see all available qualifiers, see our documentation.
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
[vulnerability][acl] Worker scripts with irregular extensions must be blocked
diff --git a/demo/hook-callback.js b/demo/hook-callback.js index 7daaba6f..1014aafd 100644 --- a/demo/hook-callback.js +++ b/demo/hook-callback.js @@ -1360,8 +1360,11 @@ else { applyAcl /* for recursive application of ACL */) { let opType = aclArgs[4]; if (opType === 'x') { - let url = normalizedArgs[0].trim().toLowerCase(); - if (url.startsWith('blob:') || url.startsWith('data:')) { + let url = new URL(normalizedArgs[0], hook.parameters.baseURI); + if (url.protocol === 'blob:' || url.protocol === 'data:') { + return false; + } + if (!url.pathname.match(/\.m?js$/)) { return false; } } @@ -1389,8 +1392,11 @@ else { applyAcl /* for recursive application of ACL */) { let opType = aclArgs[4]; if (opType === 'x') { - let url = normalizedArgs[0].trim().toLowerCase(); - if (url.startsWith('blob:') || url.startsWith('data:')) { + let url = new URL(normalizedArgs[0], hook.parameters.baseURI); + if (url.protocol === 'blob:' || url.protocol === 'data:') { + return false; + } + if (!url.pathname.match(/\.m?js$/)) { return false; } }
The text was updated successfully, but these errors were encountered:
[README] Add a note for Fix #318 Check extensions for Worker/SharedWo…
aef432d
…rker URLs
0.3.6 with [vulnerability][acl] Fix #318 Check extensions for Worker/…
b7ece1d
…ShareWorker URLs
b9a1561
No branches or pull requests
[vulnerability][acl] Worker scripts with irregular extensions must be blocked
Root Cause
Fix
The text was updated successfully, but these errors were encountered: