XMLHttpRequest access the file:// when we on http:// domain

Hi,

XMLHttpRequest can access the local files when we on http domain, you can produce from this repo https://github.com/selam/jsdom-xmlhttp-bug, this can be serius security problem, attacker can steal some your local files easly becouse XMLHttpRequest doesnt care window.location.href or window.document.URL

When i try to access local files from http domain from browser i got two error messages on console

XMLHttpRequest cannot load file:///home/timu/workspace/jsdom-xmlhttp-bug/test.html. Cross origin requests are only supported for protocol schemes: http, data, chrome, chrome-extension, https, chrome-extension-resource.(anonymous function) @ test.html:12

test.html:12 Uncaught NetworkError: Failed to execute 'send' on 'XMLHttpRequest': Failed to load 'file:///home/timu/workspace/jsdom-xmlhttp-bug/test.html'.

Also i haven’t check yet but i believe XMLHttpRequest and jsdom also doesn’t care Cross origin, X-Frame-Options, Content-Security-Policy, X-XSS-Protection headers from responses

[domenic]

Introducing such a change in a big codebase is huuuuge work, as you have to change how everything has been required.

You don’t have to change anything. The codebase is meant to run in a browser, so if it’s using require there, then browserify it, like @niftylettuce did.

What is the issue in “leaking” window properties to the global scope?

The Node global environment is not a browser global environment. Creating some monster hybrid where parts of it become pointers to a newly-created jsdom window, and parts of it are Node.js, causes many issues. Not the least of which is that jsdom is not designed to work in that environment, accessed via external pointers.

What you are doing is like trying to do a test in the browser by creating an iframe, setting window.window = iframe.contentWindow, window.document = iframe.contentWindow.document. You would never actually do this. You would just load your tests in the iframe.

[domenic]

but I really don’t see another way of running tests in Node.js without “smattering” some of the globals from jsdom to Node.js

Did you not see https://github.com/tmpvar/jsdom/issues/1203#issuecomment-160725194 ?

So what’s the recommended approach to create, use and destroy a sandbox for each test suite, that can run tests described in Node.js?

The approach in https://github.com/tmpvar/jsdom/issues/1203#issuecomment-160725194