-          Your point holds for all  communication with WebSocket, not just setExpectedPzh. 

-          setExpectedPzh will be set by application that we have trusted. So it goes to point how we trust application?

-          I could make random web page connection, does not have to use setExpectedPzh even I can call unRegisterDevice. 

-          I have been always under assumption this is some privileged application that will solve this. 

-          This is needed to allow beginPzpEnrolment/endEnrolment from trusted PZH to be accepted. 

-          At line 46, I unset expectedPzhAddress. 

 

From: John Lyle [mailto:notifications@github.com] 
Sent: 07 June 2013 10:48
To: webinos/webinos-pzp
Cc: Habib Virji
Subject: Re: [webinos-pzp] System test/ synchronization and remove friendlyName (#21)

 

In lib/pzp_receiveMessage.js:

> +                PzpObject.handleProcessedMessage(validMsgObj, conn);
> +            });
> +        } catch (err) {
> +            PzpObject.emit("EXCEPTION", new Error("failed in processing message received" + err));
> +        } finally {
> +            conn.resume ();// unlocks socket.
> +        }
> +    };
> +
> +    this.handleProcessedMessage = function(validMsgObj, conn) {
> +        logger.log ("msg received " + JSON.stringify (validMsgObj));
> +        if (PzpObject.checkConnectedPzh(validMsgObj.from)    || // Currently Connected PZH
> +            PzpObject.checkConnectedPzp(validMsgObj.from)    || // Currently Connected PZPs
> +            PzpObject.checkConnectedWebApp(validMsgObj.from) || // Currently Connected PZH
> +            validMsgObj.payload.status === "registerBrowser" || // Special exception as this is first msg from browser
> +            expectedPzhAddress                               || // Enrollment message comes from this address

If I'm a random web page, and I open a websocket to the PZP and send a 'setExpectedPzh' message to my own domain name...

Can I then send any message to the PZP that I like, despite not being a valid application?

—
Reply to this email directly or view it on GitHub <https://github.com/webinos/webinos-pzp/pull/21/files#r4585648> .  <https://github.com/notifications/beacon/XUg7godVN2O0jV1-5T0xO9NSB5W6rANo54spR6MQzO5RsvUzPYxpjHrlVPu0KcZl.gif>