Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion Cordova.podspec
Original file line number Diff line number Diff line change
Expand Up @@ -39,7 +39,7 @@ Pod::Spec.new do |s|
s.default_subspec = 'Cordova'
s.subspec 'Cordova' do |cordova|
cordova.source_files = 'CordovaLib/Classes/**/*.{h,m}', 'CordovaLib/Cordova/Cordova.h'
cordova.public_header_files = 'CordovaLib/Classes/Public/CDV.h', 'CordovaLib/Classes/Public/CDVAppDelegate.h', 'CordovaLib/Classes/Public/CDVAvailability.h', 'CordovaLib/Classes/Public/CDVAvailabilityDeprecated.h', 'CordovaLib/Classes/Public/CDVCommandDelegate.h', 'CordovaLib/Classes/Public/CDVCommandDelegateImpl.h', 'CordovaLib/Classes/Public/CDVCommandQueue.h', 'CordovaLib/Classes/Public/CDVConfigParser.h', 'CordovaLib/Classes/Public/CDVInvokedUrlCommand.h', 'CordovaLib/Classes/Public/CDVPlugin+Resources.h', 'CordovaLib/Classes/Public/CDVPlugin.h', 'CordovaLib/Classes/Public/CDVPluginResult.h', 'CordovaLib/Classes/Public/CDVScreenOrientationDelegate.h', 'CordovaLib/Classes/Public/CDVTimer.h', 'CordovaLib/Classes/Public/CDVViewController.h', 'CordovaLib/Classes/Public/CDVWebViewEngineProtocol.h', 'CordovaLib/Classes/Private/Plugins/CDVWebViewEngine/CDVWebViewUIDelegate.h', 'CordovaLib/Classes/Public/CDVWhitelist.h', 'CordovaLib/Cordova/Cordova.h', 'CordovaLib/Classes/Public/NSDictionary+CordovaPreferences.h', 'CordovaLib/Classes/Public/NSMutableArray+QueueAdditions.h'
cordova.public_header_files = 'CordovaLib/Classes/Public/CDV.h', 'CordovaLib/Classes/Public/CDVAllowList.h', 'CordovaLib/Classes/Public/CDVAppDelegate.h', 'CordovaLib/Classes/Public/CDVAvailability.h', 'CordovaLib/Classes/Public/CDVAvailabilityDeprecated.h', 'CordovaLib/Classes/Public/CDVCommandDelegate.h', 'CordovaLib/Classes/Public/CDVCommandDelegateImpl.h', 'CordovaLib/Classes/Public/CDVCommandQueue.h', 'CordovaLib/Classes/Public/CDVConfigParser.h', 'CordovaLib/Classes/Public/CDVInvokedUrlCommand.h', 'CordovaLib/Classes/Public/CDVPlugin+Resources.h', 'CordovaLib/Classes/Public/CDVPlugin.h', 'CordovaLib/Classes/Public/CDVPluginResult.h', 'CordovaLib/Classes/Public/CDVScreenOrientationDelegate.h', 'CordovaLib/Classes/Public/CDVTimer.h', 'CordovaLib/Classes/Public/CDVViewController.h', 'CordovaLib/Classes/Public/CDVWebViewEngineProtocol.h', 'CordovaLib/Classes/Private/Plugins/CDVWebViewEngine/CDVWebViewUIDelegate.h', 'CordovaLib/Cordova/Cordova.h', 'CordovaLib/Classes/Public/NSDictionary+CordovaPreferences.h', 'CordovaLib/Classes/Public/NSMutableArray+QueueAdditions.h'
cordova.prefix_header_contents = ''
cordova.requires_arc = true
end
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -18,7 +18,7 @@
*/

#import <Cordova/CDVPlugin.h>
#import <Cordova/CDVWhitelist.h>
#import <Cordova/CDVAllowList.h>

#define CDVWebViewNavigationType int

Expand All @@ -30,7 +30,7 @@ typedef NS_ENUM(NSInteger, CDVIntentAndNavigationFilterValue) {

@interface CDVIntentAndNavigationFilter : CDVPlugin <NSXMLParserDelegate>

+ (CDVIntentAndNavigationFilterValue) filterUrl:(NSURL*)url intentsWhitelist:(CDVWhitelist*)intentsWhitelist navigationsWhitelist:(CDVWhitelist*)navigationsWhitelist;
+ (CDVIntentAndNavigationFilterValue) filterUrl:(NSURL*)url allowIntentsList:(CDVAllowList*)allowIntentsList navigationsAllowList:(CDVAllowList*)navigationsAllowList;
+ (BOOL)shouldOverrideLoadWithRequest:(NSURLRequest*)request navigationType:(CDVWebViewNavigationType)navigationType filterValue:(CDVIntentAndNavigationFilterValue)filterValue;
+ (BOOL)shouldOpenURLRequest:(NSURLRequest*)request navigationType:(CDVWebViewNavigationType)navigationType;
@end
Original file line number Diff line number Diff line change
Expand Up @@ -24,8 +24,8 @@ @interface CDVIntentAndNavigationFilter ()

@property (nonatomic, readwrite) NSMutableArray* allowIntents;
@property (nonatomic, readwrite) NSMutableArray* allowNavigations;
@property (nonatomic, readwrite) CDVWhitelist* allowIntentsWhitelist;
@property (nonatomic, readwrite) CDVWhitelist* allowNavigationsWhitelist;
@property (nonatomic, readwrite) CDVAllowList* allowIntentsList;
@property (nonatomic, readwrite) CDVAllowList* allowNavigationsList;

@end

Expand Down Expand Up @@ -61,8 +61,8 @@ - (void)parserDidStartDocument:(NSXMLParser*)parser

- (void)parserDidEndDocument:(NSXMLParser*)parser
{
self.allowIntentsWhitelist = [[CDVWhitelist alloc] initWithArray:self.allowIntents];
self.allowNavigationsWhitelist = [[CDVWhitelist alloc] initWithArray:self.allowNavigations];
self.allowIntentsList = [[CDVAllowList alloc] initWithArray:self.allowIntents];
self.allowNavigationsList = [[CDVAllowList alloc] initWithArray:self.allowNavigations];
}

- (void)parser:(NSXMLParser*)parser parseErrorOccurred:(NSError*)parseError
Expand All @@ -79,13 +79,13 @@ - (void)pluginInitialize
}
}

+ (CDVIntentAndNavigationFilterValue) filterUrl:(NSURL*)url intentsWhitelist:(CDVWhitelist*)intentsWhitelist navigationsWhitelist:(CDVWhitelist*)navigationsWhitelist
+ (CDVIntentAndNavigationFilterValue) filterUrl:(NSURL*)url allowIntentsList:(CDVAllowList*)allowIntentsList navigationsAllowList:(CDVAllowList*)navigationsAllowList
{
// a URL can only allow-intent OR allow-navigation, if both are specified,
// only allow-navigation is allowed

BOOL allowNavigationsPass = [navigationsWhitelist URLIsAllowed:url logFailure:NO];
BOOL allowIntentPass = [intentsWhitelist URLIsAllowed:url logFailure:NO];
BOOL allowNavigationsPass = [navigationsAllowList URLIsAllowed:url logFailure:NO];
BOOL allowIntentPass = [allowIntentsList URLIsAllowed:url logFailure:NO];

if (allowNavigationsPass && allowIntentPass) {
return CDVIntentAndNavigationFilterValueNavigationAllowed;
Expand All @@ -100,7 +100,7 @@ + (CDVIntentAndNavigationFilterValue) filterUrl:(NSURL*)url intentsWhitelist:(CD

- (CDVIntentAndNavigationFilterValue) filterUrl:(NSURL*)url
{
return [[self class] filterUrl:url intentsWhitelist:self.allowIntentsWhitelist navigationsWhitelist:self.allowNavigationsWhitelist];
return [[self class] filterUrl:url allowIntentsList:self.allowIntentsList navigationsAllowList:self.allowNavigationsList];
}

#define CDVWebViewNavigationTypeLinkClicked 0
Expand All @@ -118,8 +118,8 @@ + (BOOL)shouldOpenURLRequest:(NSURLRequest*)request navigationType:(CDVWebViewNa

+ (BOOL)shouldOverrideLoadWithRequest:(NSURLRequest*)request navigationType:(CDVWebViewNavigationType)navigationType filterValue:(CDVIntentAndNavigationFilterValue)filterValue
{
NSString* allowIntents_whitelistRejectionFormatString = @"ERROR External navigation rejected - <allow-intent> not set for url='%@'";
NSString* allowNavigations_whitelistRejectionFormatString = @"ERROR Internal navigation rejected - <allow-navigation> not set for url='%@'";
NSString* allowIntents_allowListRejectionFormatString = @"ERROR External navigation rejected - <allow-intent> not set for url='%@'";
NSString* allowNavigations_allowListRejectionFormatString = @"ERROR Internal navigation rejected - <allow-navigation> not set for url='%@'";

NSURL* url = [request URL];

Expand All @@ -136,10 +136,10 @@ + (BOOL)shouldOverrideLoadWithRequest:(NSURLRequest*)request navigationType:(CDV
return NO;
case CDVIntentAndNavigationFilterValueNoneAllowed:
// allow-navigation attempt failed for sure
NSLog(@"%@", [NSString stringWithFormat:allowNavigations_whitelistRejectionFormatString, [url absoluteString]]);
NSLog(@"%@", [NSString stringWithFormat:allowNavigations_allowListRejectionFormatString, [url absoluteString]]);
// anchor tag link means it was an allow-intent attempt that failed as well
if (CDVWebViewNavigationTypeLinkClicked == navigationType) {
NSLog(@"%@", [NSString stringWithFormat:allowIntents_whitelistRejectionFormatString, [url absoluteString]]);
NSLog(@"%@", [NSString stringWithFormat:allowIntents_allowListRejectionFormatString, [url absoluteString]]);
}
return NO;
}
Expand Down
2 changes: 1 addition & 1 deletion CordovaLib/Classes/Public/CDV.h
Original file line number Diff line number Diff line change
Expand Up @@ -25,6 +25,6 @@
#import "CDVViewController.h"
#import "CDVCommandDelegate.h"
#import "CDVInvokedUrlCommand.h"
#import "CDVWhitelist.h"
#import "CDVAllowList.h"
#import "CDVScreenOrientationDelegate.h"
#import "CDVTimer.h"
Original file line number Diff line number Diff line change
Expand Up @@ -19,11 +19,11 @@

#import <Foundation/Foundation.h>

extern NSString* const kCDVDefaultWhitelistRejectionString;
extern NSString* const kCDVDefaultAllowListRejectionString;

@interface CDVWhitelist : NSObject
@interface CDVAllowList : NSObject

@property (nonatomic, copy) NSString* whitelistRejectionFormatString;
@property (nonatomic, copy) NSString* allowListRejectionFormatString;

- (id)initWithArray:(NSArray*)array;
- (BOOL)schemeIsAllowed:(NSString*)scheme;
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -17,12 +17,12 @@ Licensed to the Apache Software Foundation (ASF) under one
under the License.
*/

#import "CDVWhitelist.h"
#import "CDVAllowList.h"

NSString* const kCDVDefaultWhitelistRejectionString = @"ERROR whitelist rejection: url='%@'";
NSString* const kCDVDefaultAllowListRejectionString = @"ERROR allowList rejection: url='%@'";
NSString* const kCDVDefaultSchemeName = @"cdv-default-scheme";

@interface CDVWhitelistPattern : NSObject {
@interface CDVAllowListPattern : NSObject {
@private
NSRegularExpression* _scheme;
NSRegularExpression* _host;
Expand All @@ -36,7 +36,7 @@ - (bool)matches:(NSURL*)url;

@end

@implementation CDVWhitelistPattern
@implementation CDVAllowListPattern

+ (NSString*)regexFromPattern:(NSString*)pattern allowWildcards:(bool)allowWildcards
{
Expand All @@ -62,14 +62,14 @@ - (id)initWithScheme:(NSString*)scheme host:(NSString*)host port:(NSString*)port
if ((scheme == nil) || [scheme isEqualToString:@"*"]) {
_scheme = nil;
} else {
_scheme = [NSRegularExpression regularExpressionWithPattern:[CDVWhitelistPattern regexFromPattern:scheme allowWildcards:NO] options:NSRegularExpressionCaseInsensitive error:nil];
_scheme = [NSRegularExpression regularExpressionWithPattern:[CDVAllowListPattern regexFromPattern:scheme allowWildcards:NO] options:NSRegularExpressionCaseInsensitive error:nil];
}
if ([host isEqualToString:@"*"] || host == nil) {
_host = nil;
} else if ([host hasPrefix:@"*."]) {
_host = [NSRegularExpression regularExpressionWithPattern:[NSString stringWithFormat:@"([a-z0-9.-]*\\.)?%@", [CDVWhitelistPattern regexFromPattern:[host substringFromIndex:2] allowWildcards:false]] options:NSRegularExpressionCaseInsensitive error:nil];
_host = [NSRegularExpression regularExpressionWithPattern:[NSString stringWithFormat:@"([a-z0-9.-]*\\.)?%@", [CDVAllowListPattern regexFromPattern:[host substringFromIndex:2] allowWildcards:false]] options:NSRegularExpressionCaseInsensitive error:nil];
} else {
_host = [NSRegularExpression regularExpressionWithPattern:[CDVWhitelistPattern regexFromPattern:host allowWildcards:NO] options:NSRegularExpressionCaseInsensitive error:nil];
_host = [NSRegularExpression regularExpressionWithPattern:[CDVAllowListPattern regexFromPattern:host allowWildcards:NO] options:NSRegularExpressionCaseInsensitive error:nil];
}
if ((port == nil) || [port isEqualToString:@"*"]) {
_port = nil;
Expand All @@ -79,7 +79,7 @@ - (id)initWithScheme:(NSString*)scheme host:(NSString*)host port:(NSString*)port
if ((path == nil) || [path isEqualToString:@"/*"]) {
_path = nil;
} else {
_path = [NSRegularExpression regularExpressionWithPattern:[CDVWhitelistPattern regexFromPattern:path allowWildcards:YES] options:0 error:nil];
_path = [NSRegularExpression regularExpressionWithPattern:[CDVAllowListPattern regexFromPattern:path allowWildcards:YES] options:0 error:nil];
}
}
return self;
Expand All @@ -96,29 +96,29 @@ - (bool)matches:(NSURL*)url

@end

@interface CDVWhitelist ()
@interface CDVAllowList ()

@property (nonatomic, readwrite, strong) NSMutableArray* whitelist;
@property (nonatomic, readwrite, strong) NSMutableArray* allowList;
@property (nonatomic, readwrite, strong) NSMutableSet* permittedSchemes;

- (void)addWhiteListEntry:(NSString*)pattern;
- (void)addAllowListEntry:(NSString*)pattern;

@end

@implementation CDVWhitelist
@implementation CDVAllowList

@synthesize whitelist, permittedSchemes, whitelistRejectionFormatString;
@synthesize allowList, permittedSchemes, allowListRejectionFormatString;

- (id)initWithArray:(NSArray*)array
{
self = [super init];
if (self) {
self.whitelist = [[NSMutableArray alloc] init];
self.allowList = [[NSMutableArray alloc] init];
self.permittedSchemes = [[NSMutableSet alloc] init];
self.whitelistRejectionFormatString = kCDVDefaultWhitelistRejectionString;
self.allowListRejectionFormatString = kCDVDefaultAllowListRejectionString;

for (NSString* pattern in array) {
[self addWhiteListEntry:pattern];
[self addAllowListEntry:pattern];
}
}
return self;
Expand Down Expand Up @@ -158,15 +158,15 @@ - (BOOL)isIPv4Address:(NSString*)externalHost
return YES;
}

- (void)addWhiteListEntry:(NSString*)origin
- (void)addAllowListEntry:(NSString*)origin
{
if (self.whitelist == nil) {
if (self.allowList == nil) {
return;
}

if ([origin isEqualToString:@"*"]) {
NSLog(@"Unlimited access to network resources");
self.whitelist = nil;
self.allowList = nil;
self.permittedSchemes = nil;
} else { // specific access
NSRegularExpression* parts = [NSRegularExpression regularExpressionWithPattern:@"^((\\*|[A-Za-z-]+):/?/?)?(((\\*\\.)?[^*/:]+)|\\*)?(:(\\d+))?(/.*)?" options:0 error:nil];
Expand Down Expand Up @@ -204,10 +204,10 @@ - (void)addWhiteListEntry:(NSString*)origin

if (scheme == nil) {
// XXX making it stupid friendly for people who forget to include protocol/SSL
[self.whitelist addObject:[[CDVWhitelistPattern alloc] initWithScheme:@"http" host:host port:port path:path]];
[self.whitelist addObject:[[CDVWhitelistPattern alloc] initWithScheme:@"https" host:host port:port path:path]];
[self.allowList addObject:[[CDVAllowListPattern alloc] initWithScheme:@"http" host:host port:port path:path]];
[self.allowList addObject:[[CDVAllowListPattern alloc] initWithScheme:@"https" host:host port:port path:path]];
} else {
[self.whitelist addObject:[[CDVWhitelistPattern alloc] initWithScheme:scheme host:host port:port path:path]];
[self.allowList addObject:[[CDVAllowListPattern alloc] initWithScheme:scheme host:host port:port path:path]];
}

if (self.permittedSchemes != nil) {
Expand Down Expand Up @@ -240,8 +240,8 @@ - (BOOL)URLIsAllowed:(NSURL*)url

- (BOOL)URLIsAllowed:(NSURL*)url logFailure:(BOOL)logFailure
{
// Shortcut acceptance: Are all urls whitelisted ("*" in whitelist)?
if (whitelist == nil) {
// Shortcut acceptance: Are all urls allowListed ("*" in allowList)?
if (allowList == nil) {
return YES;
}

Expand All @@ -263,8 +263,8 @@ - (BOOL)URLIsAllowed:(NSURL*)url logFailure:(BOOL)logFailure
}
}

// Check the url against patterns in the whitelist
for (CDVWhitelistPattern* p in self.whitelist) {
// Check the url against patterns in the allowList
for (CDVAllowListPattern* p in self.allowList) {
if ([p matches:url]) {
return YES;
}
Expand All @@ -279,7 +279,7 @@ - (BOOL)URLIsAllowed:(NSURL*)url logFailure:(BOOL)logFailure

- (NSString*)errorStringForURL:(NSURL*)url
{
return [NSString stringWithFormat:self.whitelistRejectionFormatString, [url absoluteString]];
return [NSString stringWithFormat:self.allowListRejectionFormatString, [url absoluteString]];
}

@end
2 changes: 1 addition & 1 deletion CordovaLib/Classes/Public/CDVCommandDelegate.h
Original file line number Diff line number Diff line change
Expand Up @@ -22,7 +22,7 @@

@class CDVPlugin;
@class CDVPluginResult;
@class CDVWhitelist;
@class CDVAllowList;

typedef NSURL* (^ UrlTransformerBlock)(NSURL*);

Expand Down
4 changes: 2 additions & 2 deletions CordovaLib/Classes/Public/CDVViewController.m
Original file line number Diff line number Diff line change
Expand Up @@ -180,7 +180,7 @@ - (void)loadSettings

[self parseSettingsWithParser:delegate];

// Get the plugin dictionary, whitelist and settings from the delegate.
// Get the plugin dictionary, allowList and settings from the delegate.
self.pluginsMap = delegate.pluginsDict;
self.startupPluginNames = delegate.startupPluginNames;
self.settings = delegate.settings;
Expand Down Expand Up @@ -610,7 +610,7 @@ - (void)registerPlugin:(CDVPlugin*)plugin withPluginName:(NSString*)pluginName
- (id)getCommandInstance:(NSString*)pluginName
{
// first, we try to find the pluginName in the pluginsMap
// (acts as a whitelist as well) if it does not exist, we return nil
// (acts as a allowList as well) if it does not exist, we return nil
// NOTE: plugin names are matched as lowercase to avoid problems - however, a
// possible issue is there can be duplicates possible if you had:
// "org.apache.cordova.Foo" and "org.apache.cordova.foo" - only the lower-cased entry will match
Expand Down
2 changes: 1 addition & 1 deletion CordovaLib/Cordova/Cordova.h
Original file line number Diff line number Diff line change
Expand Up @@ -44,6 +44,6 @@ FOUNDATION_EXPORT const unsigned char CordovaVersionString[];
#import <Cordova/NSDictionary+CordovaPreferences.h>
#import <Cordova/NSMutableArray+QueueAdditions.h>
#import <Cordova/CDVWebViewUIDelegate.h>
#import <Cordova/CDVWhitelist.h>
#import <Cordova/CDVAllowList.h>
#import <Cordova/CDVScreenOrientationDelegate.h>
#import <Cordova/CDVTimer.h>
Loading