Fascinated/Minetrack
1
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

Fix XSS by parsing player counts as raw data and validating favicon URIs (#116)

Browse Source 
* Fix XSS by parsing player counts as raw data (instead of parsing it)

* Ensure the returned favicon is a data URI

* Force server favicon size to 64px

* Increase specificity of data URI validation

The previous commit would happily accept any domain (or subdomain) that started with "data"
This commit is contained in:
Hugo Manrique
2019-09-05 23:15:44 +02:00
committed by Crypt
parent 6da613bbb8
commit 0392fce6c3
3 changed files with 15 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

17
lib/ping.js
View File

@ -11,15 +11,22 @@ function pingMinecraftPC(host, port, timeout, callback, version) {
if (err) {
callback(err, null);
} else {
// Remap our JSON into our custom structure.
// Remap our JSON into our custom structure.
var favicon;
// Ensure the returned favicon is a data URI
if (res.favicon.indexOf('data:image/') === 0) {
favicon = res.favicon;
}
callback(null, {
players: {
online: res.players.online,
max: res.players.max
online: parseInt(res.players.online),
max: parseInt(res.players.max)
},
version: res.version.protocol,
version: parseInt(res.version.protocol),
latency: util.getCurrentTimeMs() - startTime,
favicon: res.favicon
favicon
});
}
}, timeout, version);