5ee6971a61
This is attempt 3 at rolling-forward c/106190
New Dependency
==============
This adds polymer-resin as a bower archive.
See `bower info polymer-resin\#1.2.6-beta` for details.
Polymer-resin is part of the larger polymer project so is
license compatible.
Integration
===========
The main application element, app/elements/gr-app.html, now HTML
imports polymer-resin per
github.com/Polymer/polymer-resin/blob/master/getting-started.md#loading
It uses the following configuration:
1. All dynamic IDs are allowed.
2. Policy violation reports are sent to the dev console.
test/common-test-setup.html does the same so that tests are run in the
same environment.
Testing
=======
1. Running local tests
gerrit $ ./polygerrit-ui/app/run_tests.sh
With 1.2.6-beta tests run green on (Chrome, Firefox, Safari).
2. Testing for false positives
I ran two servers.
a. polygerrit-ui/run_server.sh
b. gerrit.war per https://git.eclipse.org/r/Documentation/dev-readme.html
I noticed that in both the dev console showed 'initResin' early and
paging around showed no violation reports.
3. Testing for true negatives
I patched in the diff at the end of this description, and reran
both server environments.
I noted that browsing to localhost:8081/#javascript:alert(1)
and localhost:8080/#javascript:alert(1) both showed a
violation report about javascript:alert(1) being rejected.
Clicking Changes / XSS did not result in a popup.
Differences
===========
This loads the non-debug version but configured with a console reporter
so should minimize code size and speed overhead.
This loads via gr-app so the input is automatically vulcanized.
--- a/polygerrit-ui/app/elements/core/gr-main-header/gr-main-header.js
+++ b/polygerrit-ui/app/elements/core/gr-main-header/gr-main-header.js
@@ -56,6 +56,11 @@
url: '/q/status:abandoned',
name: 'Abandoned',
},
+ { // HACK DO NOT SUBMIT
+ url: (location.hash && location.hash.replace(/^#/, ''))
+ || '/echoes_hash',
+ name: 'XSS',
+ },
],
}];
--- a/polygerrit-ui/app/elements/shared/gr-dropdown/gr-dropdown.js
+++ b/polygerrit-ui/app/elements/shared/gr-dropdown/gr-dropdown.js
@@ -93,6 +93,7 @@
},
_computeRelativeURL(path) {
+if (path && /^\w+\:/.test(path)) { return path; } // HACK DO NOT SUBMIT
const host = window.location.host;
return this._computeURLHelper(host, path);
},
Change-Id: I38bfa124abd4fb35972833f29fc1664ec2404e34
232 lines
5.1 KiB
Python
232 lines
5.1 KiB
Python
# DO NOT EDIT
|
|
# generated with the following command:
|
|
#
|
|
# tools/js/bower2bazel.py -w lib/js/bower_archives.bzl -b lib/js/bower_components.bzl
|
|
#
|
|
|
|
load("//tools/bzl:js.bzl", "bower_component")
|
|
|
|
def define_bower_components():
|
|
bower_component(
|
|
name = "accessibility-developer-tools",
|
|
license = "//lib:LICENSE-DO_NOT_DISTRIBUTE",
|
|
)
|
|
bower_component(
|
|
name = "async",
|
|
license = "//lib:LICENSE-DO_NOT_DISTRIBUTE",
|
|
)
|
|
bower_component(
|
|
name = "chai",
|
|
license = "//lib:LICENSE-DO_NOT_DISTRIBUTE",
|
|
)
|
|
bower_component(
|
|
name = "es6-promise",
|
|
license = "//lib:LICENSE-es6-promise",
|
|
seed = True,
|
|
)
|
|
bower_component(
|
|
name = "fetch",
|
|
license = "//lib:LICENSE-fetch",
|
|
seed = True,
|
|
)
|
|
bower_component(
|
|
name = "iron-a11y-announcer",
|
|
license = "//lib:LICENSE-polymer",
|
|
deps = [ ":polymer" ],
|
|
)
|
|
bower_component(
|
|
name = "iron-a11y-keys-behavior",
|
|
license = "//lib:LICENSE-polymer",
|
|
deps = [ ":polymer" ],
|
|
)
|
|
bower_component(
|
|
name = "iron-autogrow-textarea",
|
|
license = "//lib:LICENSE-polymer",
|
|
deps = [
|
|
":iron-behaviors",
|
|
":iron-flex-layout",
|
|
":iron-form-element-behavior",
|
|
":iron-validatable-behavior",
|
|
":polymer",
|
|
],
|
|
seed = True,
|
|
)
|
|
bower_component(
|
|
name = "iron-behaviors",
|
|
license = "//lib:LICENSE-polymer",
|
|
deps = [
|
|
":iron-a11y-keys-behavior",
|
|
":polymer",
|
|
],
|
|
)
|
|
bower_component(
|
|
name = "iron-dropdown",
|
|
license = "//lib:LICENSE-polymer",
|
|
deps = [
|
|
":iron-a11y-keys-behavior",
|
|
":iron-behaviors",
|
|
":iron-overlay-behavior",
|
|
":iron-resizable-behavior",
|
|
":neon-animation",
|
|
":polymer",
|
|
],
|
|
seed = True,
|
|
)
|
|
bower_component(
|
|
name = "iron-fit-behavior",
|
|
license = "//lib:LICENSE-polymer",
|
|
deps = [ ":polymer" ],
|
|
)
|
|
bower_component(
|
|
name = "iron-flex-layout",
|
|
license = "//lib:LICENSE-polymer",
|
|
deps = [ ":polymer" ],
|
|
)
|
|
bower_component(
|
|
name = "iron-form-element-behavior",
|
|
license = "//lib:LICENSE-polymer",
|
|
deps = [ ":polymer" ],
|
|
)
|
|
bower_component(
|
|
name = "iron-input",
|
|
license = "//lib:LICENSE-polymer",
|
|
deps = [
|
|
":iron-a11y-announcer",
|
|
":iron-validatable-behavior",
|
|
":polymer",
|
|
],
|
|
seed = True,
|
|
)
|
|
bower_component(
|
|
name = "iron-meta",
|
|
license = "//lib:LICENSE-polymer",
|
|
deps = [ ":polymer" ],
|
|
)
|
|
bower_component(
|
|
name = "iron-overlay-behavior",
|
|
license = "//lib:LICENSE-polymer",
|
|
deps = [
|
|
":iron-a11y-keys-behavior",
|
|
":iron-fit-behavior",
|
|
":iron-resizable-behavior",
|
|
":polymer",
|
|
],
|
|
seed = True,
|
|
)
|
|
bower_component(
|
|
name = "iron-resizable-behavior",
|
|
license = "//lib:LICENSE-polymer",
|
|
deps = [ ":polymer" ],
|
|
)
|
|
bower_component(
|
|
name = "iron-selector",
|
|
license = "//lib:LICENSE-polymer",
|
|
deps = [ ":polymer" ],
|
|
seed = True,
|
|
)
|
|
bower_component(
|
|
name = "iron-test-helpers",
|
|
license = "//lib:LICENSE-DO_NOT_DISTRIBUTE",
|
|
deps = [ ":polymer" ],
|
|
seed = True,
|
|
)
|
|
bower_component(
|
|
name = "iron-validatable-behavior",
|
|
license = "//lib:LICENSE-polymer",
|
|
deps = [
|
|
":iron-meta",
|
|
":polymer",
|
|
],
|
|
)
|
|
bower_component(
|
|
name = "lodash",
|
|
license = "//lib:LICENSE-DO_NOT_DISTRIBUTE",
|
|
)
|
|
bower_component(
|
|
name = "mocha",
|
|
license = "//lib:LICENSE-DO_NOT_DISTRIBUTE",
|
|
)
|
|
bower_component(
|
|
name = "moment",
|
|
license = "//lib:LICENSE-moment",
|
|
seed = True,
|
|
)
|
|
bower_component(
|
|
name = "neon-animation",
|
|
license = "//lib:LICENSE-polymer",
|
|
deps = [
|
|
":iron-meta",
|
|
":iron-resizable-behavior",
|
|
":iron-selector",
|
|
":polymer",
|
|
":web-animations-js",
|
|
],
|
|
)
|
|
bower_component(
|
|
name = "page",
|
|
license = "//lib:LICENSE-page.js",
|
|
seed = True,
|
|
)
|
|
bower_component(
|
|
name = "polymer",
|
|
license = "//lib:LICENSE-polymer",
|
|
deps = [ ":webcomponentsjs" ],
|
|
seed = True,
|
|
)
|
|
bower_component(
|
|
name = "polymer-resin",
|
|
license = "//lib:LICENSE-polymer",
|
|
deps = [
|
|
":polymer",
|
|
":webcomponentsjs",
|
|
],
|
|
seed = True,
|
|
)
|
|
bower_component(
|
|
name = "promise-polyfill",
|
|
license = "//lib:LICENSE-promise-polyfill",
|
|
deps = [ ":polymer" ],
|
|
seed = True,
|
|
)
|
|
bower_component(
|
|
name = "sinon-chai",
|
|
license = "//lib:LICENSE-DO_NOT_DISTRIBUTE",
|
|
)
|
|
bower_component(
|
|
name = "sinonjs",
|
|
license = "//lib:LICENSE-DO_NOT_DISTRIBUTE",
|
|
)
|
|
bower_component(
|
|
name = "stacky",
|
|
license = "//lib:LICENSE-DO_NOT_DISTRIBUTE",
|
|
)
|
|
bower_component(
|
|
name = "test-fixture",
|
|
license = "//lib:LICENSE-DO_NOT_DISTRIBUTE",
|
|
seed = True,
|
|
)
|
|
bower_component(
|
|
name = "web-animations-js",
|
|
license = "//lib:LICENSE-Apache2.0",
|
|
)
|
|
bower_component(
|
|
name = "web-component-tester",
|
|
license = "//lib:LICENSE-DO_NOT_DISTRIBUTE",
|
|
deps = [
|
|
":accessibility-developer-tools",
|
|
":async",
|
|
":chai",
|
|
":lodash",
|
|
":mocha",
|
|
":sinon-chai",
|
|
":sinonjs",
|
|
":stacky",
|
|
":test-fixture",
|
|
],
|
|
seed = True,
|
|
)
|
|
bower_component(
|
|
name = "webcomponentsjs",
|
|
license = "//lib:LICENSE-polymer",
|
|
)
|