5ee6971a61
This is attempt 3 at rolling-forward c/106190
New Dependency
==============
This adds polymer-resin as a bower archive.
See `bower info polymer-resin\#1.2.6-beta` for details.
Polymer-resin is part of the larger polymer project so is
license compatible.
Integration
===========
The main application element, app/elements/gr-app.html, now HTML
imports polymer-resin per
github.com/Polymer/polymer-resin/blob/master/getting-started.md#loading
It uses the following configuration:
1. All dynamic IDs are allowed.
2. Policy violation reports are sent to the dev console.
test/common-test-setup.html does the same so that tests are run in the
same environment.
Testing
=======
1. Running local tests
gerrit $ ./polygerrit-ui/app/run_tests.sh
With 1.2.6-beta tests run green on (Chrome, Firefox, Safari).
2. Testing for false positives
I ran two servers.
a. polygerrit-ui/run_server.sh
b. gerrit.war per https://git.eclipse.org/r/Documentation/dev-readme.html
I noticed that in both the dev console showed 'initResin' early and
paging around showed no violation reports.
3. Testing for true negatives
I patched in the diff at the end of this description, and reran
both server environments.
I noted that browsing to localhost:8081/#javascript:alert(1)
and localhost:8080/#javascript:alert(1) both showed a
violation report about javascript:alert(1) being rejected.
Clicking Changes / XSS did not result in a popup.
Differences
===========
This loads the non-debug version but configured with a console reporter
so should minimize code size and speed overhead.
This loads via gr-app so the input is automatically vulcanized.
--- a/polygerrit-ui/app/elements/core/gr-main-header/gr-main-header.js
+++ b/polygerrit-ui/app/elements/core/gr-main-header/gr-main-header.js
@@ -56,6 +56,11 @@
url: '/q/status:abandoned',
name: 'Abandoned',
},
+ { // HACK DO NOT SUBMIT
+ url: (location.hash && location.hash.replace(/^#/, ''))
+ || '/echoes_hash',
+ name: 'XSS',
+ },
],
}];
--- a/polygerrit-ui/app/elements/shared/gr-dropdown/gr-dropdown.js
+++ b/polygerrit-ui/app/elements/shared/gr-dropdown/gr-dropdown.js
@@ -93,6 +93,7 @@
},
_computeRelativeURL(path) {
+if (path && /^\w+\:/.test(path)) { return path; } // HACK DO NOT SUBMIT
const host = window.location.host;
return this._computeURLHelper(host, path);
},
Change-Id: I38bfa124abd4fb35972833f29fc1664ec2404e34
45 lines
1.2 KiB
Python
45 lines
1.2 KiB
Python
package(
|
|
default_visibility = ["//visibility:public"],
|
|
)
|
|
|
|
load("//tools/bzl:js.bzl", "bower_component_bundle")
|
|
load("//tools/bzl:genrule2.bzl", "genrule2")
|
|
|
|
bower_component_bundle(
|
|
name = "polygerrit_components.bower_components",
|
|
deps = [
|
|
"//lib/js:es6-promise",
|
|
"//lib/js:fetch",
|
|
# TODO(hanwen): this is inserted separately in the UI zip. Do we need this here?
|
|
"//lib/js:highlightjs",
|
|
"//lib/js:iron-a11y-keys-behavior",
|
|
"//lib/js:iron-autogrow-textarea",
|
|
"//lib/js:iron-dropdown",
|
|
"//lib/js:iron-input",
|
|
"//lib/js:iron-overlay-behavior",
|
|
"//lib/js:iron-selector",
|
|
"//lib/js:moment",
|
|
"//lib/js:page",
|
|
"//lib/js:polymer",
|
|
"//lib/js:polymer-resin",
|
|
"//lib/js:promise-polyfill",
|
|
],
|
|
)
|
|
|
|
genrule2(
|
|
name = "fonts",
|
|
srcs = [
|
|
"//lib/fonts:robotomono",
|
|
],
|
|
outs = ["fonts.zip"],
|
|
cmd = " && ".join([
|
|
"mkdir -p $$TMP/fonts",
|
|
"cp $(SRCS) $$TMP/fonts/",
|
|
"cd $$TMP",
|
|
"find fonts/ -exec touch -t 198001010000 '{}' ';'",
|
|
"zip -qr $$ROOT/$@ fonts",
|
|
]),
|
|
output_to_bindir = 1,
|
|
visibility = ["//visibility:public"],
|
|
)
|