From e546f3cab95ec26d44c17cdb9a6d4f28701a9277 Mon Sep 17 00:00:00 2001 From: Oyvind Sean Kinsey Date: Mon, 2 Sep 2013 13:49:44 -0700 Subject: [PATCH] Remove possible XSS attack vector. --- src/easyxdm.swf | Bin 1767 -> 1770 bytes src/flash/net.easyxdm.flash/Main.as | 2 +- 2 files changed, 1 insertion(+), 1 deletion(-) diff --git a/src/easyxdm.swf b/src/easyxdm.swf index 0a8200503ffdbb093d2ee40205de297003dbc216..eafb2695c2bb61a1761e82a90e827c5a7a90f2d7 100644 GIT binary patch literal 1770 zcmVOmEzIcY2_J3;sjL!6}Z+(F7?n$zoCbUn@4D#LYc5ioo zySI02L*`e2Y#ZRz5ahKt_;+9!@NaDhKX*qb@r$FiYIV)3eP=aAFtcjeF1#5%JVsJK z{GR#-7^yZLZ_{$1?R(ObJ8c1vEyu1~Qh+1errd(smgVQYx>%6VB8_6H_^7zBQha)U z397#5NpJ(D4t0+u+MX|=W;xC#8b_t=RS^W}#ERN55N>_dYD3L)T~U*^=hCe0i-x@o zFaw@%H*uHQS#Z22NWUY%3|=(mOb}ME^JHmtW=U*znlsY3Y62RL6>Ndnmcn;2j{D)D z=;CjK1jrE(uC?jdZquxJtyagiYZloxU)XZXg!P?3iWd4+>-e_Zfh{T9bAW2zizO8i zkBcr#h@~jXK!$;VRj=oxc#$uR%Ym9N&BAiJg!*}}hVsk4)ock@2C(8`?D?4Gc*8#8 zki`0nMlwt_Mz*E5E`5{-Oi&o7FKWVmF6w4W0cOMZS|&`JV!Mr7;(`L&9n48A+^{hr zxT5@mjSbjP>!LlK@B5y96v9ySCo4?=wN6ioD5~vB-I_G zK9ar&n(ekb63ii5&#9(f>>N;;pl_x`dmMxwijekb zm?cy;GU=f*%?y@2P(s7ZXQ-O0FkfBtC>A=nkC2@d8rer^DJgVlAEDDpp~HI!DNZ;Z zTr@^A_kISLr{P$J>MYOW@o0>39*HAVRN!y|shEI);PLxTf#oOr!Q%I5AsJaA8G#Z% z7S4~cc(#Z}#>1M|F5>4E)k61hl%-bCglj;G@9G+FcZAiC7bsSZVm-mYd%Rzczb7kM zwsk7uNW{#s+k10=ngO#kkUjjKDaJIMeZ^ej=v*b+J%J8`jxI(QODb%>FbTZ_(P=Zr zXfIu>WP52)EaReaK9kzp_4je-Sv;h4xZ^8J!wb$A5(Y1(=+5~qO^O$CdsoO&tPu1@ zdrMs)Qy-xIAV(u$Oc@u|{1R(@SfLQe@4lp3nXb%JP?r@pm5`_W& zO663z-O1iC7&FE!dxgksfl2I-jVrl0Emz~TTvH|X-_)+fYF7)YYvMt;&dw~(6Fi>l z^Gc}k(LL3WaZgYU6obAIt<6(>H+iP(#t2ek(BLfoJJ%hjdZuCtpJI1pQ+N6fa>LV&Tiq$VO!%sZ$}>f8fv|@3_|C)o zhp!DxX@e7Xflu9>o?_xY;sGL!Hc zqnqS~)m;m;lX9cfos9ab?KZsf<}-R+Wto#Qa3qaar1jyEK_^0xL?&~nLnk9lQ#zR@wm!;9{UXWiw{OZ}(*KvN58M@x-*#8T&zb11 zxCU|7bZsshH?MJpu;Q1>vGG_aY3|8e%+dN+1BIo6ds;}oLU{7^zZUkGTGsR-WpU#+ zWs_f8P=>pyMFfAyA+Y*rVLe}6T_~17ZrOqQ4>Gq=ew|Uz%Z3l=$fOqDb6KG0?cV?Z M0RR630E2!MA%=Ewi2wiq literal 1767 zcmVpW2x|^Z~lNC&_Y}&^|RYobP_O zd%OGF)!wlMnO^|1ZGaO)kk?-0-@akMzttfeZjVmjh_lsdb=9hUYc)kMy<*ueydM31 zl%!t#n)(_TsWu&N!*ZbQd(xBJZ2=E0$F5safFs$S+n3vEZjbf?zpg6x= ze0+Bis=nt*a08_db&n<5o-d(hInD+eN2RS55d`SOvN|vjZhggSL(OwtQIodk(yHx? zhP?$a4W4f|@sybvaJ(i+zazj5o;7Ao5LU4LXmMqFQEYUY)6%zU0ve7LY=YR5!gn!_ zyWynh;%|cl$Po~(wc*%q)2w-|R>!q#7TGnQ*>cl_we3KP7W!4|__o}JO)1;6fNI{e zMHLaxi!Muu#VE=^hJk@qujiw9kuQwPftoMS2$@uX3BG7~GE$$#_!Ll9@!D=(Y?T`j zbT$I%!z}ZJ`gx^ZvRVSFUJ@=LzeYzbEeuSjv;X2bVdCQO-PtBptEh636h%tY2eI=ilR0t%ZRzwC=QAy(QVJU)RVoR^K(T5R>oEr2<@0hp z9__?#}&52F%hx_HaB^jA=OilDWj$nM$^M3>^j?U5qZ4RM>oB0($$R zugy3_XX#oc+e?FD88?lynbhvCzlSH!;73XycYI}Oc)|HX!r;Xe-8ny}N%36n&B;eP z-bbN9B1XWNG|sE_1=jkYLVl8SeMz-5Rhc8tFDh&@Ax+PmA{(0mb>vQ=11fZtugUPZ zl%LUaMvD&Y)GYfMBkLCL05o&yR zM|E916I7SPpsz)Ha}?ioUg^3qf|M9EIgS6$bjPS@sUpJn)FE=Y_bje@|s^+#LAKuynFu+)~(W^)sG4 z=T3#j`AUDTzVC&C$_xMG*`d^)AA2IH$1&k&fGTT|??cwV%O#=@gcVY^6t|vjcE2#- z{-qoRR^^?0{T-xi$(YW?9q1Z6Rjg$9@c+}kSZ(E3;AK_ah9dF@cn0JQtw5pdM_`4jjM|U!#7y{#?5O?A*}d?a%?OXN}7B026MFkR}k diff --git a/src/flash/net.easyxdm.flash/Main.as b/src/flash/net.easyxdm.flash/Main.as index 93bc32c8..05c58010 100644 --- a/src/flash/net.easyxdm.flash/Main.as +++ b/src/flash/net.easyxdm.flash/Main.as @@ -95,7 +95,7 @@ class Main // add the createChannel method ExternalInterface.addCallback("createChannel", { }, function(channel:String, secret:String, remoteOrigin:String, isHost:Boolean) { - if (!Main.Validate(channel)) return; + if (!Main.Validate(channel) || !Main.Validate(secret)) return; log("creating channel " + channel); // get the remote domain