Merge pull request mailru#346 from im-saxo/hotfixes

flash xss: patch from @mala

Author: RubaXa

Gruntfile.js

@@ -131,7 +131,7 @@ module.exports = function (grunt) {
 mxmlc: {
 core: {
 options: {
-rawConfig: '-static-link-runtime-shared-libraries=true -compiler.debug=true' +
+rawConfig: '-target-player=10.1 -static-link-runtime-shared-libraries=true -compiler.debug=true' +
 ' -library-path+=flash/core/lib/blooddy_crypto.swc -library-path+=flash/core/lib/EnginesLibrary.swc'
 },
 files: {

dist/FileAPI.flash.swf

@@ -1,7 +1,5 @@
 package
 {
-import com.github.im_saxo.FilterFlashVars;
-
 import flash.display.Sprite;
 import flash.display.StageAlign;
 import flash.display.StageQuality;
@@ -13,7 +11,7 @@ package
 
 /**
  * 
- * @author v.demidov
+ * @author v.demidov <v.demidov@gmail.com> https://github.com/im-saxo
  * 
  */
 public class FileAPI_flash extends Sprite
@@ -38,7 +36,6 @@ package
  */
 protected function init(event:Event = null):void
 {
-trace ("{FlashFileAPI} - init");
 removeEventListener(Event.ADDED_TO_STAGE, init);
 
 // config stage
@@ -50,21 +47,10 @@ package
 addChild(_graphicContext);
 
 // initiate controller
-_controller = new AppController(_graphicContext, parseFlashVars());
+_controller = new AppController(_graphicContext, loaderInfo.parameters);
 // add some global listeners
 stage.addEventListener(Event.RESIZE, _controller.onStageResize);
 loaderInfo.uncaughtErrorEvents.addEventListener(UncaughtErrorEvent.UNCAUGHT_ERROR, _controller.onUncaughtError);
 }
-
-/**
- * Use only parameters from FlashVars and ignore parameters from URL query string.
- * Query string parameters can lead to XSS, and since we use only FlashVars, 
- * we can ignore query completely.
- * 
- */
-private function parseFlashVars():Object
-{
-return FilterFlashVars.filterFlashVars(loaderInfo.parameters, loaderInfo.url);
-}
 }
-}
+}

flash/core/lib/FilterFlashVarsLibrary.swc

@@ -1,6 +1,7 @@
 package ru.mail.communication
 {
 import flash.external.ExternalInterface;
+import flash.utils.ByteArray;
 
 import ru.mail.data.vo.ErrorVO;
 import ru.mail.data.vo.FileVO;
@@ -67,7 +68,6 @@ package ru.mail.communication
 _call(_callback, data, data2);
 }
 catch (e:Error)	{
-trace ("callJS caused an exception", e);
 }
 }
 
@@ -82,12 +82,10 @@ package ru.mail.communication
 var isReady:Boolean = false;
 try {
 var r:* = _call(callback, {type:"ready", flashId:flashId});
-trace( "JSCaller.notifyJSAboutAppReady() ", triesCount );
 
 isReady = ( r != null );
 }
 catch ( e:Error ) {
-trace ("notifyJSAboutAppReady error", e);
 }
 
 return isReady;
@@ -111,7 +109,6 @@ package ru.mail.communication
 _call(callback, { type:eventType, flashId:flashId });
 }
 catch (e:Error) {
-trace ("notifyJSMouseEvents error", e);
 }
 }
 
@@ -126,8 +123,6 @@ package ru.mail.communication
  */
 public function notifyJSFilesEvents(eventType:String, filesVector:Vector.<FileVO> = null):void
 {
-trace ("{JSCaller} - notifyJSFilesEvents, eventType", eventType)
-
 var details:Object = new Object();
 details.type = eventType;
 
@@ -164,7 +159,6 @@ package ru.mail.communication
 _call(callback, details);
 }
 catch (e:Error) {
-trace ("notifyJSFilesEvents error",e);
 }
 }
 
@@ -189,7 +183,6 @@ package ru.mail.communication
 _call(callback, details);
 }
 catch (e:Error) {
-trace ("notifyJSErrors error",e);
 }
 }
 
@@ -204,7 +197,6 @@ package ru.mail.communication
 _call(callback, { type:'camera', error:error, flashId:flashId });
 }
 catch (e:Error) {
-trace ("notifyCameraStatus error", e);
 }
 }
 
@@ -222,13 +214,34 @@ package ru.mail.communication
 _call(callback, {type:"error", message:errorVO.getError(), flashId:flashId});
 }
 catch (e:Error) {
-trace ("notifyJSErrors error",e);
 }
 }
-
+
+private function clone(source:Object):* {
+var myBA:ByteArray = new ByteArray();
+myBA.writeObject(source);
+myBA.position = 0;
+return(myBA.readObject());
+}
+
+private function _escape(data:*):* {
+if (typeof data === 'string') {
+return data.replace(/\\/g, '\\\\');
+} else if (typeof data === 'object') {
+var ret:* = clone(data);
+for (var i:String in data) {
+ret[i] = _escape(data[i]);
+}
+return ret;
+}
+return data;
+}
+
 private function _call(callback:String, data:Object, data2:Object = null):* {
+data = _escape(data);
 if ( callback.match(/^FileAPI\.Flash\.(onEvent|_fn\.fileapi\d+)$/) ) {
 if (data2) {
+data2 = _escape(data2);
 return ExternalInterface.call(callback, data, data2);
 }
 else {
@@ -240,4 +253,4 @@ package ru.mail.communication
 }
 }
 }
-}
+}