Skip to content

Commit e2552c9

Browse files
lukastaegertlukastaegert
authored
Fix DOM Clobbering CVE (#5671)
1 parent 10ab90e commit e2552c9

File tree

40 files changed

+93
-91
lines changed

40 files changed

+93
-91
lines changed

‎src/ast/nodes/MetaProperty.ts

+3-3
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,10 @@
11
import type MagicString from 'magic-string';
22
import type { InternalModuleFormat } from '../../rollup/types';
3-
import type { PluginDriver } from '../../utils/PluginDriver';
43
import { escapeId } from '../../utils/escapeId';
54
import type { GenerateCodeSnippets } from '../../utils/generateCodeSnippets';
65
import { DOCUMENT_CURRENT_SCRIPT } from '../../utils/interopHelpers';
76
import { dirname, normalize, relative } from '../../utils/path';
7+
import type { PluginDriver } from '../../utils/PluginDriver';
88
import type { RenderOptions } from '../../utils/renderHelpers';
99
import type { NodeInteraction } from '../NodeInteractions';
1010
import { INTERACTION_ACCESSED } from '../NodeInteractions';
@@ -158,7 +158,7 @@ const getRelativeUrlFromDocument = (relativePath: string, umd = false) =>
158158
getResolveUrl(
159159
`'${escapeId(relativePath)}', ${
160160
umd ? `typeof document === 'undefined' ? location.href : ` : ''
161-
}document.currentScript && document.currentScript.src || document.baseURI`
161+
}document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScript.src || document.baseURI`
162162
);
163163

164164
const getGenericImportMetaMechanism =
@@ -180,7 +180,7 @@ const getFileUrlFromRelativePath = (path: string) =>
180180
const getUrlFromDocument = (chunkId: string, umd = false) =>
181181
`${
182182
umd ? `typeof document === 'undefined' ? location.href : ` : ''
183-
}(${DOCUMENT_CURRENT_SCRIPT} && ${DOCUMENT_CURRENT_SCRIPT}.src || new URL('${escapeId(
183+
}(${DOCUMENT_CURRENT_SCRIPT} && ${DOCUMENT_CURRENT_SCRIPT}.tagName.toUpperCase() === 'SCRIPT' && ${DOCUMENT_CURRENT_SCRIPT}.src || new URL('${escapeId(
184184
chunkId
185185
)}', document.baseURI).href)`;
186186

‎test/chunking-form/samples/asset-needs-code-reference/_expected/cjs/main.js

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
'use strict';
22

3-
var asset2 = (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/logo2.svg').href : new URL('logo2.svg', document.currentScript && document.currentScript.src || document.baseURI).href);
3+
var asset2 = (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/logo2.svg').href : new URL('logo2.svg', document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScript.src || document.baseURI).href);
44

55
{
66
const image = document.createElement('img');

‎test/chunking-form/samples/emit-file/emit-chunk-with-importer/_expected/cjs/main.js

+3-3
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎test/chunking-form/samples/emit-file/emit-chunk-worker/_expected/cjs/chunks/nested.js

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
'use strict';
22

33
const getWorkerMessage = () => new Promise(resolve => {
4-
const worker = new Worker((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/worker-proxy.js').href : new URL('worker-proxy.js', document.currentScript && document.currentScript.src || document.baseURI).href));
4+
const worker = new Worker((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/worker-proxy.js').href : new URL('worker-proxy.js', document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScript.src || document.baseURI).href));
55
worker.onmessage = resolve;
66
});
77

‎test/chunking-form/samples/emit-file/emit-chunk-worker/_expected/cjs/chunks/worker-proxy.js

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,3 @@
11
'use strict';
22

3-
PLACEHOLDER((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/worker.js').href : new URL('worker.js', document.currentScript && document.currentScript.src || document.baseURI).href));
3+
PLACEHOLDER((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/worker.js').href : new URL('worker.js', document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScript.src || document.baseURI).href));

‎test/chunking-form/samples/emit-file/emit-chunk-worker/_expected/cjs/main.js

+1-1
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
var shared = require('./chunks/shared.js');
44

55
const getWorkerMessage = () => new Promise(resolve => {
6-
const worker = new Worker((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/chunks/worker-proxy.js').href : new URL('chunks/worker-proxy.js', document.currentScript && document.currentScript.src || document.baseURI).href));
6+
const worker = new Worker((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/chunks/worker-proxy.js').href : new URL('chunks/worker-proxy.js', document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScript.src || document.baseURI).href));
77
worker.onmessage = resolve;
88
});
99

‎test/chunking-form/samples/emit-file/emit-chunk-worklet/_expected/cjs/main.js

+1-1
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,6 @@
22

33
var shared = require('./chunks/shared.js');
44

5-
CSS.paintWorklet.addModule((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/chunks/worklet.js').href : new URL('chunks/worklet.js', document.currentScript && document.currentScript.src || document.baseURI).href));
5+
CSS.paintWorklet.addModule((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/chunks/worklet.js').href : new URL('chunks/worklet.js', document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScript.src || document.baseURI).href));
66

77
document.body.innerHTML += `<h1 style="background-image: paint(vertical-lines);">color: ${shared.color}, size: ${shared.size}</h1>`;

‎test/chunking-form/samples/emit-file/reference-files/_expected/cjs/main.js

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
'use strict';
22

3-
var logo = (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/assets/logo1-FquQRdV3.svg').href : new URL('assets/logo1-FquQRdV3.svg', document.currentScript && document.currentScript.src || document.baseURI).href);
3+
var logo = (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/assets/logo1-FquQRdV3.svg').href : new URL('assets/logo1-FquQRdV3.svg', document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScript.src || document.baseURI).href);
44

55
function showImage(url) {
66
console.log(url);

‎test/chunking-form/samples/emit-file/reference-files/_expected/cjs/nested/chunk.js

+1-1
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,6 @@
22

33
var main = require('../main.js');
44

5-
var logo = (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/../assets/logo2-DJfvToLT.svg').href : new URL('../assets/logo2-DJfvToLT.svg', document.currentScript && document.currentScript.src || document.baseURI).href);
5+
var logo = (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/../assets/logo2-DJfvToLT.svg').href : new URL('../assets/logo2-DJfvToLT.svg', document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScript.src || document.baseURI).href);
66

77
main.showImage(logo);

‎test/chunking-form/samples/emit-file/set-asset-source/_expected/cjs/main.js

+8-8
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎test/chunking-form/samples/import-meta-numeric-paths/_expected/cjs/0/1/nested.js

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
'use strict';
22

33
var _documentCurrentScript = typeof document !== 'undefined' ? document.currentScript : null;
4-
const url = (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.src || new URL('0/1/nested.js', document.baseURI).href));
4+
const url = (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('0/1/nested.js', document.baseURI).href));
55

66
exports.url = url;

‎test/chunking-form/samples/import-meta-url/_expected/cjs/main.js

+1-1
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@ function log(url) {
99
}
1010
}
1111

12-
log('main: ' + (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.src || new URL('main.js', document.baseURI).href)));
12+
log('main: ' + (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('main.js', document.baseURI).href)));
1313
Promise.resolve().then(function () { return require('./nested/chunk.js'); });
1414

1515
exports.log = log;

‎test/chunking-form/samples/import-meta-url/_expected/cjs/nested/chunk.js

+1-1
Original file line numberDiff line numberDiff line change
@@ -3,4 +3,4 @@
33
var main = require('../main.js');
44

55
var _documentCurrentScript = typeof document !== 'undefined' ? document.currentScript : null;
6-
main.log('nested: ' + (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.src || new URL('nested/chunk.js', document.baseURI).href)));
6+
main.log('nested: ' + (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('nested/chunk.js', document.baseURI).href)));

‎test/chunking-form/samples/render-chunk/_expected/cjs/chunk-dep2-DaLIbws0.js ‎test/chunking-form/samples/render-chunk/_expected/cjs/chunk-dep2-Cr_zOuBy.js

+5-5
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
'use strict';
22

33
var num = 2;
4-
console.log('referenced asset', (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/asset-test-C4X7hChn').href : new URL('asset-test-C4X7hChn', document.currentScript && document.currentScript.src || document.baseURI).href));
4+
console.log('referenced asset', (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/asset-test-C4X7hChn').href : new URL('asset-test-C4X7hChn', document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScript.src || document.baseURI).href));
55

66
exports.num = num;
77
console.log({
@@ -18,24 +18,24 @@ console.log({
1818
"name": "dep2",
1919
"type": "chunk",
2020
"dynamicImports": [],
21-
"fileName": "chunk-dep2-DaLIbws0.js",
21+
"fileName": "chunk-dep2-Cr_zOuBy.js",
2222
"implicitlyLoadedBefore": [],
2323
"importedBindings": {},
2424
"imports": [],
2525
"modules": {
2626
"**/dep2.js": {
27-
"code": "var num = 2;\nconsole.log('referenced asset', (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/asset-test-C4X7hChn').href : new URL('asset-test-C4X7hChn', document.currentScript && document.currentScript.src || document.baseURI).href));",
27+
"code": "var num = 2;\nconsole.log('referenced asset', (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/asset-test-C4X7hChn').href : new URL('asset-test-C4X7hChn', document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScript.src || document.baseURI).href));",
2828
"originalLength": 19,
2929
"removedExports": [],
3030
"renderedExports": [
3131
"num"
3232
],
33-
"renderedLength": 269
33+
"renderedLength": 330
3434
}
3535
},
3636
"referencedFiles": [
3737
"asset-test-C4X7hChn"
3838
]
3939
});
40-
console.log('all chunks', ["entry-main1-s6RHXqBe.js","entry-main2-DPo9-iBy.js","chunk-dep2-DaLIbws0.js"])
40+
console.log('all chunks', ["entry-main1-CW_cw0go.js","entry-main2-CvqsXhWd.js","chunk-dep2-Cr_zOuBy.js"])
4141
console.log('referenced asset in renderChunk', 'asset-test-C4X7hChn');

‎test/chunking-form/samples/render-chunk/_expected/cjs/entry-main1-s6RHXqBe.js ‎test/chunking-form/samples/render-chunk/_expected/cjs/entry-main1-CW_cw0go.js

+11-11
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,12 @@
11
'use strict';
22

3-
var dep2 = require('./chunk-dep2-DaLIbws0.js');
3+
var dep2 = require('./chunk-dep2-Cr_zOuBy.js');
44

55
var num = 1;
6-
console.log('referenced asset', (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/asset-test-C4X7hChn').href : new URL('asset-test-C4X7hChn', document.currentScript && document.currentScript.src || document.baseURI).href));
6+
console.log('referenced asset', (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/asset-test-C4X7hChn').href : new URL('asset-test-C4X7hChn', document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScript.src || document.baseURI).href));
77

88
console.log(num + dep2.num);
9-
console.log('referenced asset', (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/asset-test-C4X7hChn').href : new URL('asset-test-C4X7hChn', document.currentScript && document.currentScript.src || document.baseURI).href));
9+
console.log('referenced asset', (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/asset-test-C4X7hChn').href : new URL('asset-test-C4X7hChn', document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScript.src || document.baseURI).href));
1010
console.log({
1111
"exports": [],
1212
"facadeModuleId": "**/main1.js",
@@ -20,37 +20,37 @@ console.log({
2020
"name": "main1",
2121
"type": "chunk",
2222
"dynamicImports": [],
23-
"fileName": "entry-main1-s6RHXqBe.js",
23+
"fileName": "entry-main1-CW_cw0go.js",
2424
"implicitlyLoadedBefore": [],
2525
"importedBindings": {
26-
"chunk-dep2-DaLIbws0.js": [
26+
"chunk-dep2-Cr_zOuBy.js": [
2727
"num"
2828
]
2929
},
3030
"imports": [
31-
"chunk-dep2-DaLIbws0.js"
31+
"chunk-dep2-Cr_zOuBy.js"
3232
],
3333
"modules": {
3434
"**/dep1.js": {
35-
"code": "var num = 1;\nconsole.log('referenced asset', (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/asset-test-C4X7hChn').href : new URL('asset-test-C4X7hChn', document.currentScript && document.currentScript.src || document.baseURI).href));",
35+
"code": "var num = 1;\nconsole.log('referenced asset', (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/asset-test-C4X7hChn').href : new URL('asset-test-C4X7hChn', document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScript.src || document.baseURI).href));",
3636
"originalLength": 19,
3737
"removedExports": [],
3838
"renderedExports": [
3939
"num"
4040
],
41-
"renderedLength": 269
41+
"renderedLength": 330
4242
},
4343
"**/main1.js": {
44-
"code": "console.log(num + dep2.num);\nconsole.log('referenced asset', (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/asset-test-C4X7hChn').href : new URL('asset-test-C4X7hChn', document.currentScript && document.currentScript.src || document.baseURI).href));",
44+
"code": "console.log(num + dep2.num);\nconsole.log('referenced asset', (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__dirname + '/asset-test-C4X7hChn').href : new URL('asset-test-C4X7hChn', document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScript.src || document.baseURI).href));",
4545
"originalLength": 102,
4646
"removedExports": [],
4747
"renderedExports": [],
48-
"renderedLength": 285
48+
"renderedLength": 346
4949
}
5050
},
5151
"referencedFiles": [
5252
"asset-test-C4X7hChn"
5353
]
5454
});
55-
console.log('all chunks', ["entry-main1-s6RHXqBe.js","entry-main2-DPo9-iBy.js","chunk-dep2-DaLIbws0.js"])
55+
console.log('all chunks', ["entry-main1-CW_cw0go.js","entry-main2-CvqsXhWd.js","chunk-dep2-Cr_zOuBy.js"])
5656
console.log('referenced asset in renderChunk', 'asset-test-C4X7hChn');

0 commit comments

Comments
 (0)