CVE-2014-1403: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site scripting (XSS) vulnerability in name.html in easyXDM before 2.4.19 allows remote attackers to inject arbitrary web script or HTML via the location.hash value.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Published: 2014-02-05T15:10Z
Repository: https://github.com/oyvindkinsey/easyXDM
Language: HTML
Files changed: build.xml, src/Fn.js, src/changes.html, src/name.html
Commit date: 2014-01-18 13:59:56 -0800
Commit message: Fix for CVE-2014-1403

Diff: diff --git a/build.xml b/build.xml
index 19c9862..d2df4ab 100644
--- a/build.xml
+++ b/build.xml
@@ -2,11 +2,11 @@
 <project name="easyXDM" default="build" basedir=".">
 	<property file="build.properties"/>
 	<property file="build.secret.properties"/>
 	<property name="project.build.artifactdir" value="./artifacts/"/>
 	<property name="project.build.publishdir" value="./artifacts/"/>
-	<property name="project.build.version" value="2.4.18"/>
+	<property name="project.build.version" value="2.4.19"/>
 	
 	<!-- Setup classpath for js-build-tools ant tasks -->
 	<path id="js-build-tasks.classpath">
 		<pathelement location="."/>
 		<fileset dir="tools/js-build-tools/lib">
diff --git a/src/Fn.js b/src/Fn.js
index 271e047..d29fb32 100644
--- a/src/Fn.js
+++ b/src/Fn.js
@@ -56,10 +56,13 @@
          */
         get: function(name, del){
             // #ifdef debug
             this._trace("retrieving function " + name);
             // #endif
+            if (!_map.hasOwnProperty(name)) {
+                return;
+            }
             var fn = _map[name];
             // #ifdef debug
             if (!fn) {
                 this._trace(name + " not found");
             }
diff --git a/src/changes.html b/src/changes.html
index d8bec02..56e2e1f 100644
--- a/src/changes.html
+++ b/src/changes.html
@@ -3,10 +3,17 @@
     <head>
         <title>Changes</title>
     </head>
     <body>
         <ul>
+             <li>
+                2.4.19 18.01.14
+                <br/>
+                Removed XSS vulnerability:
+                <br/>
+                - XSS due to lack of validation in name.html (CVE-2014-1403) - disclosed by Krzystof Kotowicz (Cure53)
+            </li>
             <li>
                 2.4.18 21.09.13
                 <br/>
                 Removed two sets of XSS vulnerabilities:
                 <br/>
diff --git a/src/name.html b/src/name.html
index d30e7b2..aab6a82 100644
--- a/src/name.html
+++ b/src/name.html
@@ -22,10 +22,13 @@
                     channel = hash;
                 }
                 else {
                     channel = hash.substring(0, indexOf);
                     url = decodeURIComponent(hash.substring(indexOf + 1));
+                    if (url && !/https?:\/\//.test(url)) {
+                        throw new Error('Invalid url');
+                    }
                 }
                 switch (location.hash.substring(2, 3)) {
                     case "2":
                         // NameTransport local
                         window.parent.parent.easyXDM.Fn.get(channel)(window.name);

Vulnerable code: 	<property name="project.build.version" value="2.4.18"/>
Fixed code: 	<property name="project.build.version" value="2.4.19"/>
            if (!_map.hasOwnProperty(name)) {
                return;
            }
             <li>
                2.4.19 18.01.14
                <br/>
                Removed XSS vulnerability:
                <br/>
                - XSS due to lack of validation in name.html (CVE-2014-1403) - disclosed by Krzystof Kotowicz (Cure53)
            </li>
                    if (url && !/https?:\/\//.test(url)) {
                        throw new Error('Invalid url');
                    }