assign-gingerly 0.0.94 → 0.0.95
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
|
@@ -0,0 +1,64 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* HTML event-handler content attributes. The browser compiles these into
|
|
3
|
+
* live event handlers as soon as they're set via `setAttribute` (and they
|
|
4
|
+
* shadow the identically-named element properties), so both forms are
|
|
5
|
+
* blocked outright — there's no safe "same-domain" version of inline script.
|
|
6
|
+
*
|
|
7
|
+
* Not exhaustive (there is no wildcard/regex support in `restrictedPropSettings`
|
|
8
|
+
* today — see docs/assign-permissions.md). Spread this array and add more
|
|
9
|
+
* names for handlers not listed here.
|
|
10
|
+
*/
|
|
11
|
+
export const xssSensitiveAttrs = [
|
|
12
|
+
'onabort', 'onanimationend', 'onanimationiteration', 'onanimationstart',
|
|
13
|
+
'onauxclick', 'onbeforeinput', 'onbeforetoggle', 'onblur',
|
|
14
|
+
'onchange', 'onclick', 'oncontextmenu', 'oncopy', 'oncut',
|
|
15
|
+
'ondblclick', 'ondrag', 'ondragend', 'ondragenter', 'ondragleave',
|
|
16
|
+
'ondragover', 'ondragstart', 'ondrop', 'onerror', 'onfocus',
|
|
17
|
+
'oninput', 'onkeydown', 'onkeypress', 'onkeyup', 'onload',
|
|
18
|
+
'onmousedown', 'onmouseenter', 'onmouseleave', 'onmousemove',
|
|
19
|
+
'onmouseout', 'onmouseover', 'onmouseup', 'onpaste',
|
|
20
|
+
'onpointerdown', 'onpointerenter', 'onpointerleave', 'onpointermove',
|
|
21
|
+
'onpointerout', 'onpointerover', 'onpointerup', 'onreset',
|
|
22
|
+
'onscroll', 'onselect', 'onsubmit', 'ontoggle',
|
|
23
|
+
'ontouchcancel', 'ontouchend', 'ontouchmove', 'ontouchstart',
|
|
24
|
+
'ontransitionend', 'onwheel',
|
|
25
|
+
];
|
|
26
|
+
/**
|
|
27
|
+
* Properties that assign raw markup/CSS into the DOM. There is no generic
|
|
28
|
+
* safe redirect for these, so they're blocked outright (Phase I) rather than
|
|
29
|
+
* gated by origin. Consumers who need HTML/CSS injection should route
|
|
30
|
+
* through a sanitizer via `useMethod` in their own extended config — see
|
|
31
|
+
* docs/assign-permissions.md, Phase II.
|
|
32
|
+
*/
|
|
33
|
+
export const xssSensitiveMarkupProps = ['innerHTML', 'outerHTML', 'srcdoc', 'cssText'];
|
|
34
|
+
/**
|
|
35
|
+
* Properties that carry a URL. Cross-origin values are blocked; same-origin
|
|
36
|
+
* values (including relative paths) are allowed through for both the
|
|
37
|
+
* property and the matching attribute. This stops `javascript:`, `data:`,
|
|
38
|
+
* and cross-origin navigation/exfiltration while leaving normal same-app
|
|
39
|
+
* links, images, scripts, and form actions working.
|
|
40
|
+
*/
|
|
41
|
+
export const xssSensitiveUrlProps = ['src', 'href', 'action', 'formAction'];
|
|
42
|
+
/**
|
|
43
|
+
* Methods most associated with runtime HTML/rich-text injection. Method
|
|
44
|
+
* blocking in `restrictedMethodSettings` is by name only, not by target type
|
|
45
|
+
* (see docs/assign-permissions.md, Phase IV), so this list is deliberately
|
|
46
|
+
* narrow to DOM-specific names unlikely to collide with unrelated methods on
|
|
47
|
+
* plain objects.
|
|
48
|
+
*/
|
|
49
|
+
export const xssSensitiveMethods = ['insertAdjacentHTML', 'setHTMLUnsafe', 'execCommand'];
|
|
50
|
+
/**
|
|
51
|
+
* A restrictive `AssignPermissions` default suitable as a starting point for
|
|
52
|
+
* any consumer that lets less-trusted input drive `assignGingerly`. Merge
|
|
53
|
+
* or spread it to tighten further — see the module doc above for examples.
|
|
54
|
+
*/
|
|
55
|
+
export const strictDefaultPermissions = {
|
|
56
|
+
crossDomainImports: false,
|
|
57
|
+
restrictedPropSettings: [
|
|
58
|
+
...xssSensitiveMarkupProps,
|
|
59
|
+
{ props: xssSensitiveUrlProps, attr: true, allowFromSameDomain: true },
|
|
60
|
+
{ props: xssSensitiveAttrs, attr: true },
|
|
61
|
+
],
|
|
62
|
+
restrictedMethodSettings: [...xssSensitiveMethods],
|
|
63
|
+
};
|
|
64
|
+
export default strictDefaultPermissions;
|
package/package.json
CHANGED