Sanitize __amp_source_origin from templates URLs (#4670)

ampproject · Aug 24, 2016 · c9fe0d2 · c9fe0d2
1 parent 7df92dd
commit c9fe0d2
Show file tree

Hide file tree

Showing 3 changed files with 13 additions and 2 deletions.
diff --git a/src/sanitizer.js b/src/sanitizer.js
@@ -20,6 +20,7 @@ import {
   isProxyOrigin,
   parseUrl,
   resolveRelativeUrl,
+  SOURCE_ORIGIN_PARAM,
 } from './url';
 import {parseSrcset} from './srcset';
 import {user} from './log';
@@ -286,6 +287,9 @@ function resolveAttrValue(tagName, attrName, attrValue) {
  * @private Visible for testing.
  */
 export function resolveUrlAttr(tagName, attrName, attrValue, windowLocation) {
+  user().assert(attrValue.indexOf(SOURCE_ORIGIN_PARAM) == -1,
+      'Source origin is not allowed in %s', attrValue);
+
   const isProxyHost = isProxyOrigin(windowLocation);
   const baseUrl = parseUrl(getSourceUrl(windowLocation));
 

diff --git a/src/url.js b/src/url.js
@@ -37,8 +37,8 @@ let cache;
 /** @private @const Matches amp_js_* paramters in query string. */
 const AMP_JS_PARAMS_REGEX = /[?&]amp_js[^&]*/;
 
-/** @private @const {string} */
-const SOURCE_ORIGIN_PARAM = '__amp_source_origin';
+/** @const {string} */
+export const SOURCE_ORIGIN_PARAM = '__amp_source_origin';
 
 /**
  * @typedef {({

diff --git a/test/functional/test-sanitizer.js b/test/functional/test-sanitizer.js
@@ -133,6 +133,13 @@ describe('sanitizeHtml', () => {
 
 describe('resolveUrlAttr', () => {
 
+  it('should throw if __amp_source_origin is set', () => {
+    expect(() => resolveUrlAttr('a', 'href',
+        '/doc2?__amp_source_origin=https://google.com',
+        'http://acme.org/doc1'))
+            .to.throw(/Source origin is not allowed in/);
+  });
+
   it('should be called by sanitizer', () => {
     expect(sanitizeHtml('<a href="/path"></a>')).to.match(/http/);
     expect(sanitizeHtml('<amp-img src="/path"></amp-img>')).to.match(/http/);