Skip to content
This repository was archived by the owner on Apr 20, 2023. It is now read-only.

Commit 4e46f32

Browse files
committed
Fix for CORS vulnerability
Summary: Sites including the raw content of the distribution zip will be susceptible to a CORS attack due to the default cors/index.html file containing an open whitelist regex.
1 parent a32ef15 commit 4e46f32

File tree

2 files changed

+2
-2
lines changed

2 files changed

+2
-2
lines changed

build.xml

+1-1
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@
44
<property file="build.secret.properties"/>
55
<property name="project.build.artifactdir" value="./artifacts/"/>
66
<property name="project.build.publishdir" value="./artifacts/"/>
7-
<property name="project.build.version" value="2.4.20"/>
7+
<property name="project.build.version" value="2.5.00"/>
88

99
<!-- Setup classpath for js-build-tools ant tasks -->
1010
<path id="js-build-tasks.classpath">

src/cors/index.html

+1-1
Original file line numberDiff line numberDiff line change
@@ -59,7 +59,7 @@
5959
// this file is by default set up to use Access Control - this means that it will use the headers set by the server to decide whether or not to allow the call to return
6060
var useAccessControl = true;
6161
// always trusted origins, can be exact strings or regular expressions
62-
var alwaysTrustedOrigins = [(/\.?easyxdm\.net/), (/xdm1/)];
62+
var alwaysTrustedOrigins = ["https://consumer.easyxdm.net"];
6363

6464
// instantiate a new easyXDM object which will handle the request
6565
var remote = new easyXDM.Rpc({

0 commit comments

Comments
 (0)