From e8b46023e47399e9dcc0057a4380ca4fe49908ee Mon Sep 17 00:00:00 2001 From: Melanie Thielker Date: Wed, 16 Mar 2016 20:04:52 +0100 Subject: Add osRequestURL and osRequestSecureURL with an options list. Only currently supported option is "allowXss" which will send the needed Access-control-allow-origin: * header to allow xss scripting against the LSL http server. --- .../CoreModules/Scripting/LSLHttp/UrlModule.cs | 15 +++++++-- OpenSim/Region/Framework/Interfaces/IUrlModule.cs | 5 +-- .../Shared/Api/Implementation/LSL_Api.cs | 4 +-- .../Shared/Api/Implementation/OSSL_Api.cs | 36 ++++++++++++++++++++++ .../ScriptEngine/Shared/Api/Interface/IOSSL_Api.cs | 3 ++ .../ScriptEngine/Shared/Api/Runtime/OSSL_Stub.cs | 10 ++++++ 6 files changed, 66 insertions(+), 7 deletions(-) diff --git a/OpenSim/Region/CoreModules/Scripting/LSLHttp/UrlModule.cs b/OpenSim/Region/CoreModules/Scripting/LSLHttp/UrlModule.cs index fffd640..f563c68 100644 --- a/OpenSim/Region/CoreModules/Scripting/LSLHttp/UrlModule.cs +++ b/OpenSim/Region/CoreModules/Scripting/LSLHttp/UrlModule.cs @@ -52,6 +52,7 @@ namespace OpenSim.Region.CoreModules.Scripting.LSLHttp public Dictionary requests; public bool isSsl; public Scene scene; + public bool allowXss; } public class RequestData @@ -192,7 +193,7 @@ namespace OpenSim.Region.CoreModules.Scripting.LSLHttp { } - public UUID RequestURL(IScriptModule engine, SceneObjectPart host, UUID itemID) + public UUID RequestURL(IScriptModule engine, SceneObjectPart host, UUID itemID, Hashtable options) { UUID urlcode = UUID.Random(); @@ -214,6 +215,10 @@ namespace OpenSim.Region.CoreModules.Scripting.LSLHttp urlData.isSsl = false; urlData.requests = new Dictionary(); urlData.scene = host.ParentGroup.Scene; + urlData.allowXss = false; + + if (options != null && options["allowXss"] != null) + urlData.allowXss = true; m_UrlMap[url] = urlData; @@ -234,7 +239,7 @@ namespace OpenSim.Region.CoreModules.Scripting.LSLHttp return urlcode; } - public UUID RequestSecureURL(IScriptModule engine, SceneObjectPart host, UUID itemID) + public UUID RequestSecureURL(IScriptModule engine, SceneObjectPart host, UUID itemID, Hashtable options) { UUID urlcode = UUID.Random(); @@ -261,7 +266,10 @@ namespace OpenSim.Region.CoreModules.Scripting.LSLHttp urlData.urlcode = urlcode; urlData.isSsl = true; urlData.requests = new Dictionary(); + urlData.allowXss = false; + if (options != null && options["allowXss"] != null) + urlData.allowXss = true; m_UrlMap[url] = urlData; @@ -559,7 +567,8 @@ namespace OpenSim.Region.CoreModules.Scripting.LSLHttp response["keepalive"] = false; response["reusecontext"] = false; - response["access_control_allow_origin"] = "*"; + if (url.allowXss) + response["access_control_allow_origin"] = "*"; //remove from map lock (url.requests) diff --git a/OpenSim/Region/Framework/Interfaces/IUrlModule.cs b/OpenSim/Region/Framework/Interfaces/IUrlModule.cs index 79e9f9d..2987184 100644 --- a/OpenSim/Region/Framework/Interfaces/IUrlModule.cs +++ b/OpenSim/Region/Framework/Interfaces/IUrlModule.cs @@ -25,6 +25,7 @@ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. */ +using System.Collections; using System.Collections.Generic; using OpenMetaverse; using OpenSim.Framework; @@ -35,8 +36,8 @@ namespace OpenSim.Region.Framework.Interfaces public interface IUrlModule { string ExternalHostNameForLSL { get; } - UUID RequestURL(IScriptModule engine, SceneObjectPart host, UUID itemID); - UUID RequestSecureURL(IScriptModule engine, SceneObjectPart host, UUID itemID); + UUID RequestURL(IScriptModule engine, SceneObjectPart host, UUID itemID, Hashtable options); + UUID RequestSecureURL(IScriptModule engine, SceneObjectPart host, UUID itemID, Hashtable options); void ReleaseURL(string url); void HttpResponse(UUID request, int status, string body); void HttpContentType(UUID request, string type); diff --git a/OpenSim/Region/ScriptEngine/Shared/Api/Implementation/LSL_Api.cs b/OpenSim/Region/ScriptEngine/Shared/Api/Implementation/LSL_Api.cs index a2abbeb..f48d42d 100644 --- a/OpenSim/Region/ScriptEngine/Shared/Api/Implementation/LSL_Api.cs +++ b/OpenSim/Region/ScriptEngine/Shared/Api/Implementation/LSL_Api.cs @@ -12039,7 +12039,7 @@ namespace OpenSim.Region.ScriptEngine.Shared.Api { m_host.AddScriptLPS(1); if (m_UrlModule != null) - return m_UrlModule.RequestSecureURL(m_ScriptEngine.ScriptModule, m_host, m_item.ItemID).ToString(); + return m_UrlModule.RequestSecureURL(m_ScriptEngine.ScriptModule, m_host, m_item.ItemID, null).ToString(); return UUID.Zero.ToString(); } @@ -12157,7 +12157,7 @@ namespace OpenSim.Region.ScriptEngine.Shared.Api m_host.AddScriptLPS(1); if (m_UrlModule != null) - return m_UrlModule.RequestURL(m_ScriptEngine.ScriptModule, m_host, m_item.ItemID).ToString(); + return m_UrlModule.RequestURL(m_ScriptEngine.ScriptModule, m_host, m_item.ItemID, null).ToString(); return UUID.Zero.ToString(); } diff --git a/OpenSim/Region/ScriptEngine/Shared/Api/Implementation/OSSL_Api.cs b/OpenSim/Region/ScriptEngine/Shared/Api/Implementation/OSSL_Api.cs index bda323a..7e88365 100644 --- a/OpenSim/Region/ScriptEngine/Shared/Api/Implementation/OSSL_Api.cs +++ b/OpenSim/Region/ScriptEngine/Shared/Api/Implementation/OSSL_Api.cs @@ -4134,5 +4134,41 @@ namespace OpenSim.Region.ScriptEngine.Shared.Api return 0; } } + + public LSL_String osRequestURL(LSL_List options) + { + CheckThreatLevel(ThreatLevel.Moderate, "osRequestSecureURL"); + m_host.AddScriptLPS(1); + + Hashtable opts = new Hashtable(); + for (int i = 0 ; i < options.Length ; i++) + { + object opt = options.Data[i]; + if (opt.ToString() == "allowXss") + opts["allowXss"] = true; + } + + if (m_UrlModule != null) + return m_UrlModule.RequestURL(m_ScriptEngine.ScriptModule, m_host, m_item.ItemID, opts).ToString(); + return UUID.Zero.ToString(); + } + + public LSL_String osRequestSecureURL(LSL_List options) + { + CheckThreatLevel(ThreatLevel.Moderate, "osRequestSecureURL"); + m_host.AddScriptLPS(1); + + Hashtable opts = new Hashtable(); + for (int i = 0 ; i < options.Length ; i++) + { + object opt = options.Data[i]; + if (opt.ToString() == "allowXss") + opts["allowXss"] = true; + } + + if (m_UrlModule != null) + return m_UrlModule.RequestSecureURL(m_ScriptEngine.ScriptModule, m_host, m_item.ItemID, opts).ToString(); + return UUID.Zero.ToString(); + } } } diff --git a/OpenSim/Region/ScriptEngine/Shared/Api/Interface/IOSSL_Api.cs b/OpenSim/Region/ScriptEngine/Shared/Api/Interface/IOSSL_Api.cs index 4e567e6..6fc5db4 100644 --- a/OpenSim/Region/ScriptEngine/Shared/Api/Interface/IOSSL_Api.cs +++ b/OpenSim/Region/ScriptEngine/Shared/Api/Interface/IOSSL_Api.cs @@ -468,5 +468,8 @@ namespace OpenSim.Region.ScriptEngine.Shared.Api.Interfaces /// string to use as pattern /// boolean LSL_Integer osRegexIsMatch(string input, string pattern); + + LSL_String osRequestURL(LSL_List options); + LSL_String osRequestSecureURL(LSL_List options); } } diff --git a/OpenSim/Region/ScriptEngine/Shared/Api/Runtime/OSSL_Stub.cs b/OpenSim/Region/ScriptEngine/Shared/Api/Runtime/OSSL_Stub.cs index 31393bb..ee07eee 100644 --- a/OpenSim/Region/ScriptEngine/Shared/Api/Runtime/OSSL_Stub.cs +++ b/OpenSim/Region/ScriptEngine/Shared/Api/Runtime/OSSL_Stub.cs @@ -1054,5 +1054,15 @@ namespace OpenSim.Region.ScriptEngine.Shared.ScriptBase { return m_OSSL_Functions.osRegexIsMatch(input, pattern); } + + public LSL_String osRequestURL(LSL_List options) + { + return m_OSSL_Functions.osRequestURL(options); + } + + public LSL_String osRequestSecureURL(LSL_List options) + { + return m_OSSL_Functions.osRequestSecureURL(options); + } } } -- cgit v1.1