esheri3/OWASP-CSRFGuard — pull request #31 by koto (2012-12-07 00:12:22+00:00)
Title: Javascript URL parsing vulnerabilities allowing for token leakage.

Similar to "//evil.com" bypass reported in #1 I've since conducted a research on URL parsing issues in different browsers ( http://kotowicz.net/absolute ) and it looks as if CSRFGuard isValidUrl() Javascript function is vulnerable to multitude of bypasses. These result in cross-domain token leakage.

For example - isValidUrl(' //evil.com') == true.

The best way to prevent those and further bypasses is to use DOM methods to create an anchor element, assign to its href and read the resulting hostname from HTMLAnchorElement.hostname ( http://www.w3.org/TR/html5/the-a-element.html ) . I've tested JS with the bundled test application and it works.