$http's JSONP should require trusted resource URLs #11352

chirayuk · 2015-03-17T21:24:54Z

$http does not perform any security checks on the URLs that it receives. It should require URLs that pass checks for $sce.RESOURCE_URL.

This should generally not have a huge impact in terms of breaking backwards compatibility. The cases that break, are where folks are performing JSONP requests to 3rd party servers. In such cases, it would be a good idea for the apps that do break to configure the $sce whitelist to include that specific trusted 3rd party server to unbreak themselves.

It might be a good idea to backport this to earlier versions if we can feel confident that we won't actually be breaking most applications.

The text was updated successfully, but these errors were encountered:

chirayuk · 2015-03-17T22:06:56Z

@petebacondarwin for triage review (milestone ok?)

petebacondarwin · 2015-03-20T11:37:43Z

@chirayuk - This sounds like a good security measure and if the mitigation is simply adding to a whitelist then it seems a reasonable breaking change. Do you think you could knock up a PR? If not, then if anyone else in the community wants to have a go at a PR that would be great too!

chirayuk · 2015-04-15T23:22:00Z

@petebacondarwin I'm working on this today.

WORK-IN-PROGRESS. Do **NOT** merge. More work needs to be done and the tests are currently broken. - JSONP should require trusted resource URLs. This would be a breaking change but maybe not too onerous since same origin URLs are trusted in the default config and you can easily whitelist any 3rd party URLs you trust in one single place (your app/module config.) - fix a bug where $http can't handle $sce wrapper URLs. Closes angular#11352 Closes angular#11328

chirayuk · 2015-04-16T21:08:26Z

I started on it yesterday but didn't have time to finish it. I won't get to it anytime today or tomorrow. However, I created a work-in-progress PR #11623 of my progress so far.

- JSONP should require trusted resource URLs. This would be a breaking change but maybe not too onerous since same origin URLs are trusted in the default config and you can easily whitelist any 3rd party URLs you trust in one single place (your app/module config.) - fix a bug where $http can't handle $sce wrapper URLs. Closes angular#11352 Closes angular#11328

Reject JSONP requests that are not trusted by `$sce` as "ResourceUrl". Closes angular#11352 BREAKING CHANGE All JSONP requests now require the URL to be whitelisted with the `$sceDelegateProvider.resourceUrlWhitelist()` method. You configure this list in a module configuration block: ``` appModule.config(['$sceDelegateProvider', function($sceDelegateProvider) { $sceDelegateProvider.resourceUrlWhiteList([ // Allow same origin resource loads. 'self', // Allow JSONP calls that match this pattern 'https://some.dataserver.com/**.jsonp?**` ]); }]); ```

Reject JSONP requests that are not trusted by `$sce` as "ResourceUrl". This change makes is easier for developers to see clearly where in their code they are making JSONP calls that may be to untrusted endpoings and forces them to think about how these URLs are generated. Be aware that this commit does not put any constraint on the parameters that will be appended to the URL. Developers should be mindful of what parameters can be attached and how they are generated. Closes angular#11352 BREAKING CHANGE All JSONP requests now require the URL to be trusted as resource URLs. There are two approaches to trust a URL: **Whitelisting with the `$sceDelegateProvider.resourceUrlWhitelist()` method.** You configure this list in a module configuration block: ``` appModule.config(['$sceDelegateProvider', function($sceDelegateProvider) { $sceDelegateProvider.resourceUrlWhiteList([ // Allow same origin resource loads. 'self', // Allow JSONP calls that match this pattern 'https://some.dataserver.com/**.jsonp?**` ]); }]); ``` **Explicitly trusting the URL via the `$sce.trustAsResourceUrl(url)` method** You can pass a trusted object instead of a string as a URL to the `$http` service: ``` var promise = $http.jsonp($sce.trustAsResourceUrl(url)); ```

… config The query parameter that will be used to transmit the JSONP callback to the server is now specified via the `jsonpCallbackParam` config value, instead of using the `JSON_CALLBACK` placeholder. * Any use of `JSON_CALLBACK` in a JSONP request URL will cause an error. * Any request that provides a parameter with the same name as that given by the `jsonpCallbackParam` config property will cause an error. This is to prevent malicious attack via the response from an app inadvertently allowing untrusted data to be used to generate the callback parameter. Closes #15161 Closes #15143 Closes #11352 Closes #11328 BREAKING CHANGE You can no longer use the `JSON_CALLBACK` placeholder in your JSONP requests. Instead you must provide the name of the query parameter that will pass the callback via the `jsonpCallbackParam` property of the config object, or app-wide via the `$http.defaults.jsonpCallbackParam` property, which is `"callback"` by default. Before this change: ``` $http.json('trusted/url?callback=JSON_CALLBACK'); $http.json('other/trusted/url', {params:cb:'JSON_CALLBACK'}); ``` After this change: ``` $http.json('trusted/url'); $http.json('other/trusted/url', {callbackParam:'cb'}); ```

The $http service will reject JSONP requests that are not trusted by `$sce` as "ResourceUrl". This change makes is easier for developers to see clearly where in their code they are making JSONP calls that may be to untrusted endpoings and forces them to think about how these URLs are generated. Be aware that this commit does not put any constraint on the parameters that will be appended to the URL. Developers should be mindful of what parameters can be attached and how they are generated. Closes angular#11352 BREAKING CHANGE All JSONP requests now require the URL to be trusted as resource URLs. There are two approaches to trust a URL: **Whitelisting with the `$sceDelegateProvider.resourceUrlWhitelist()` method.** You configure this list in a module configuration block: ``` appModule.config(['$sceDelegateProvider', function($sceDelegateProvider) { $sceDelegateProvider.resourceUrlWhiteList([ // Allow same origin resource loads. 'self', // Allow JSONP calls that match this pattern 'https://some.dataserver.com/**.jsonp?**` ]); }]); ``` **Explicitly trusting the URL via the `$sce.trustAsResourceUrl(url)` method** You can pass a trusted object instead of a string as a URL to the `$http` service: ``` var promise = $http.jsonp($sce.trustAsResourceUrl(url)); ```

… config The query parameter that will be used to transmit the JSONP callback to the server is now specified via the `jsonpCallbackParam` config value, instead of using the `JSON_CALLBACK` placeholder. * Any use of `JSON_CALLBACK` in a JSONP request URL will cause an error. * Any request that provides a parameter with the same name as that given by the `jsonpCallbackParam` config property will cause an error. This is to prevent malicious attack via the response from an app inadvertently allowing untrusted data to be used to generate the callback parameter. Closes angular#15161 Closes angular#15143 Closes angular#11352 Closes angular#11328 BREAKING CHANGE You can no longer use the `JSON_CALLBACK` placeholder in your JSONP requests. Instead you must provide the name of the query parameter that will pass the callback via the `jsonpCallbackParam` property of the config object, or app-wide via the `$http.defaults.jsonpCallbackParam` property, which is `"callback"` by default. Before this change: ``` $http.json('trusted/url?callback=JSON_CALLBACK'); $http.json('other/trusted/url', {params:cb:'JSON_CALLBACK'}); ``` After this change: ``` $http.json('trusted/url'); $http.json('other/trusted/url', {callbackParam:'cb'}); ```

chirayuk added the severity: security label Mar 17, 2015

chirayuk self-assigned this Mar 17, 2015

chirayuk added this to the 1.4.0-beta.7 / 1.3.16 milestone Mar 17, 2015

petebacondarwin added type: bug PRs plz! component: $http branch: 1.3.x labels Mar 20, 2015

matsko modified the milestones: 1.4.0-beta.7 / 1.3.16, 1.4.0-rc.1 Apr 10, 2015

chirayuk added the In Progress label Apr 15, 2015

This was referenced Apr 16, 2015

sec(http): JSONP should require trusted resource URLs #11623

Closed

Inconsistent handling of $sce trustedUrl with $http #11328

Closed

chirayuk modified the milestones: 1.4.0-rc.1, 1.4.0-rc.2 Apr 24, 2015

petebacondarwin modified the milestones: 1.5.x - migration-facilitation, 1.4.0-rc.2 May 5, 2015

petebacondarwin mentioned this issue Sep 15, 2016

feat(http): JSONP requests now require trusted resource URLs #15143

Closed

petebacondarwin closed this as completed in 6476af8 Oct 5, 2016

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

$http's JSONP should require trusted resource URLs #11352

$http's JSONP should require trusted resource URLs #11352

chirayuk commented Mar 17, 2015

chirayuk commented Mar 17, 2015

petebacondarwin commented Mar 20, 2015

chirayuk commented Apr 15, 2015

chirayuk commented Apr 16, 2015

$http's JSONP should require trusted resource URLs #11352

$http's JSONP should require trusted resource URLs #11352

Comments

chirayuk commented Mar 17, 2015

chirayuk commented Mar 17, 2015

petebacondarwin commented Mar 20, 2015

chirayuk commented Apr 15, 2015

chirayuk commented Apr 16, 2015