You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@cordova.apache.org by ia...@apache.org on 2014/08/26 22:01:40 UTC
[1/2] docs commit: CB-7291: Document new whitelist capablilities in
cordova-android 3.6.0
Repository: cordova-docs
Updated Branches:
refs/heads/master 2506d4c30 -> 2e33617b9
CB-7291: Document new whitelist capablilities in cordova-android 3.6.0
Project: http://git-wip-us.apache.org/repos/asf/cordova-docs/repo
Commit: http://git-wip-us.apache.org/repos/asf/cordova-docs/commit/dc598dee
Tree: http://git-wip-us.apache.org/repos/asf/cordova-docs/tree/dc598dee
Diff: http://git-wip-us.apache.org/repos/asf/cordova-docs/diff/dc598dee
Branch: refs/heads/master
Commit: dc598dee2dd92892ad02cad08c37a11243896d06
Parents: 2506d4c
Author: Ian Clelland <ic...@chromium.org>
Authored: Mon Jul 21 09:58:22 2014 -0400
Committer: Ian Clelland <ic...@chromium.org>
Committed: Tue Aug 26 15:59:44 2014 -0400
----------------------------------------------------------------------
docs/en/edge/guide/appdev/security/index.md | 2 +
docs/en/edge/guide/appdev/whitelist/index.md | 52 +++++++++++++++++++++--
2 files changed, 51 insertions(+), 3 deletions(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/cordova-docs/blob/dc598dee/docs/en/edge/guide/appdev/security/index.md
----------------------------------------------------------------------
diff --git a/docs/en/edge/guide/appdev/security/index.md b/docs/en/edge/guide/appdev/security/index.md
index 79aa8f8..541e87f 100644
--- a/docs/en/edge/guide/appdev/security/index.md
+++ b/docs/en/edge/guide/appdev/security/index.md
@@ -43,6 +43,8 @@ If you want network requests to be evaluated against the whitelist, then it is i
* Domain whitelisting does not work on Android API 10 and below, and WP8 for iframes and XMLHttpRequest. This means an attacker can load any domain in an iframe and any script on that page within the iframe can directly access Cordova JavaScript objects and the corresponding native Java objects. You should take this into consideration when building applications for these platforms. In practice this means making sure you target an Android API higher than 10, and that if possible you do not use an iframe to load external content - use the inAppBrowser plugin or other third-party plugins.
+* On Android, as of Cordova 3.6.0, it is now necessary to whitelist URLs outside of your application, if your application generates links to those URLs. If you application generates `tel:`, `geo:`, `sms:`, `intent:` or similar URLs, or provides links to external content which you expect to open up in the user's browser, then you will need to update your whitelist. See the Whitelist Guide for details.
+
## Iframes and the Callback Id Mechanism
http://git-wip-us.apache.org/repos/asf/cordova-docs/blob/dc598dee/docs/en/edge/guide/appdev/whitelist/index.md
----------------------------------------------------------------------
diff --git a/docs/en/edge/guide/appdev/whitelist/index.md b/docs/en/edge/guide/appdev/whitelist/index.md
index b7a8128..d097764 100644
--- a/docs/en/edge/guide/appdev/whitelist/index.md
+++ b/docs/en/edge/guide/appdev/whitelist/index.md
@@ -75,9 +75,55 @@ for `href` hyperlinks, not referenced resources such as images and
scripts. Take steps to avoid scripts from being injected into the
application.
-Navigating to non-whitelisted domains via `href` hyperlink causes the
-page to open in the default browser rather than within the
-application. (Compare this to iOS's behavior noted below.)
+__NOTE__: Some network requests do not go through the Cordova Whitelist.
+This includes <video> and <audio> resouces, WebSocket connections (on
+Android 4.4+), and possibly other non-http requests. On Android 4.4+,
+you can include a [CSP](https://developer.mozilla.org/en-US/docs/Web/Security/CSP/Introducing_Content_Security_Policy)
+header in your HTML documents to restrict access to those resources.
+On older versions of Android, it may not be possible to restrict them.
+
+### External Application Whitelist
+
+Cordova 3.6.0 introduces a second whitelist, for restricting which URLs
+are allowed to launch external applications. In previous versions of
+Cordova, all non-http URLs, such as `mailto:`, `geo:`, `sms:` and `intent`,
+were implicitly allowed to be the target of a an <a> tag. Because of the
+potential for an application to leak information, if an XSS vulnerability
+allows an attacker to construct arbitrary links, these URLs must be
+whitelisted as well, starting in Cordova 3.6.0.
+
+To allow a URL pattern to launch an external application, use an <access>
+tag in your `config.xml` file, with the `launch-external` attribute set.
+
+Examples:
+
+* To allow links to send SMS messages:
+
+ <access origin="sms:*" launch-external="yes" />
+
+* To allow links to open Maps:
+
+ <access origin="geo:*" launch-external="yes" />
+
+* To allow links to example.com to open in an external browser:
+
+ <access origin="http://example.com/*" launch-external="yes" />
+
+* To allow all non-whitelisted websites to open in an external browser:
+(This is the same as the previous behaviour for non-whitelisted URLs)
+
+ <access origin="http://*" launch-external="yes" />
+ <access origin="https://*" launch-external="yes" />
+
+* To allow access to all URLs, reverting to the Cordova 3.5.0 policy (not recommended):
+
+ <access origin="*" launch-external="yes" />
+
+When navigating to a URL from within your application, the interal whitelist
+is tested first, and if the URL is not whitelisted there, then the external
+whitelist is tested. This means that any `http:` or `https:` URLs which match
+both whitelists will be opened inside of the Cordova application, rather than
+launching the external browser.
## iOS Whitelisting
[2/2] docs commit: CB-7291: Document changes to android whitelist
origin="*"
Posted by ia...@apache.org.
CB-7291: Document changes to android whitelist origin="*"
Project: http://git-wip-us.apache.org/repos/asf/cordova-docs/repo
Commit: http://git-wip-us.apache.org/repos/asf/cordova-docs/commit/2e33617b
Tree: http://git-wip-us.apache.org/repos/asf/cordova-docs/tree/2e33617b
Diff: http://git-wip-us.apache.org/repos/asf/cordova-docs/diff/2e33617b
Branch: refs/heads/master
Commit: 2e33617b920061279b0be8a758bab11cc3785eb5
Parents: dc598de
Author: Ian Clelland <ic...@chromium.org>
Authored: Tue Aug 26 15:59:33 2014 -0400
Committer: Ian Clelland <ic...@chromium.org>
Committed: Tue Aug 26 15:59:48 2014 -0400
----------------------------------------------------------------------
docs/en/edge/guide/appdev/whitelist/index.md | 7 +++++++
1 file changed, 7 insertions(+)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/cordova-docs/blob/2e33617b/docs/en/edge/guide/appdev/whitelist/index.md
----------------------------------------------------------------------
diff --git a/docs/en/edge/guide/appdev/whitelist/index.md b/docs/en/edge/guide/appdev/whitelist/index.md
index d097764..2a1a3c3 100644
--- a/docs/en/edge/guide/appdev/whitelist/index.md
+++ b/docs/en/edge/guide/appdev/whitelist/index.md
@@ -75,6 +75,13 @@ for `href` hyperlinks, not referenced resources such as images and
scripts. Take steps to avoid scripts from being injected into the
application.
+__NOTE__: In order to prevent external URLs such as `mailto:` from being opened
+in the Cordova webview as of Cordova 3.6.0, specifying `origin="*"` will
+implicity add rules for http and https protocols. If you require access to
+additional custom protocols, then you should also add them explicity to the
+whitelist. Also see "External Application Whitelist" below for more information
+on launching external applications by URL.
+
__NOTE__: Some network requests do not go through the Cordova Whitelist.
This includes <video> and <audio> resouces, WebSocket connections (on
Android 4.4+), and possibly other non-http requests. On Android 4.4+,