Comments on: Uploading files cross-domain, ajax-style

By: Guest

Guest — Fri, 26 Jul 2013 20:46:00 +0000

Hi when I am trying to use this its adding NAN to the resolveURL. something like this 13:58:13.617:{Private}: resolved url ‘https://mydomain.comNaN’

var REMOTE= “https://mydomain.com”;

var remote = new easyXDM.Rpc({
remote: REMOTE + + “/staging/data/upload_handler.aspx”,
onReady: function(){
//display the upload form
var frm = document.getElementById(“frmUpload”);
frm.action = REMOTE + “/staging/data/uploadphoto.json”;
btn = document.getElementById(“btnSubmit”);

can someone help me with what I am missing?

By: Smitenka

Smitenka — Tue, 08 Jan 2013 01:13:00 +0000

Hi.
I have an interesting case. I’ve tried this code and works great. But i need something a bit different. I have a Parent website, which holds and iframe that points to localhost (it’s a must).
Now i need to get a file from http://localhost/myFile.png to my Parents website. Your example is based on file input. In my case it a local url. And i can’t submit to php with a custom link.
Thank you.

By: lera

lera — Fri, 28 Dec 2012 07:45:00 +0000

set to ‘pre’ tag ‘white-space:pre-wrap’ style please =)

By: Saša Milenković

Saša Milenković — Tue, 11 Dec 2012 09:21:00 +0000

I am trying to use one form to select multiple files and then post each with separate post request using “multipart/form-data” as content type. I have “not allowed by Access-Control-Allow-Origin.” error. Could easyXDM help me with this post requests? Have you any example for multi-selected files (HTML5 for input type=file” has flag: multiple=”multiple”)?

By: Dmitry Stepankov

Dmitry Stepankov — Mon, 09 Apr 2012 14:02:00 +0000

it’s diffucult (((

By: Nobody

Nobody — Mon, 13 Feb 2012 07:03:00 +0000

Kind of important that a code blog has CSS such that you can read the code. Fixed width design can’t die soon enough.

By: Matteo Depalo

Matteo Depalo — Wed, 11 Jan 2012 11:34:00 +0000

I’m not really sure where to put the script to return the response to the consumer. Could you be more specific? This is all really new to me…

By: Øyvind Sean Kinsey

Øyvind Sean Kinsey — Wed, 07 Dec 2011 16:46:00 +0000

Ah, I see the attack vector you are referring to now, the fact that the HashTransport will inject an I frame – I thought you were referring to a more general one. Full links are obscured by the commenting system.

As you say, this frame is hidden and will not never be visible to any users – but to avoid the issue in total, you could use the Acl mechanism to only allow certain frames.

By: Noreply

Noreply — Wed, 07 Dec 2011 15:41:00 +0000

ok, i was wrong. let’s say the file coming
from http://www.phishing.com has nothing but
the following JavaScript code:

parent.window.location.href=’http://twitter.phishing.com’;

In this case when the user clicks on the
link from the email, then the user will be
redirected to http://twitter.phishing.com
where a twitter like login screen is displayed.

to prevent this we have to set the acl property, i.e.
acl : new Array(“*.twitter.com”)
This way easyxdm only trusts *.twitter.com domains and
therefore http://twitter.phishing.com would
throw an error if passed via xdm_e.

another option would be that in case upload-rpc.html
is called first of all the xdm_e parameter is checked
on server side. now if the server recognizes that
xdm_e has an invalid url (i.e. from an other domain
than expected) the the server will return a 404 page.
but this also means one has to trust that easyxdm never
changes the usage of xdm_e.

By: Noreply

Noreply — Wed, 07 Dec 2011 10:26:00 +0000

I think Anon wants to know if there is a possibility to make the upload-rpc.html file display/render the content of any other site. If that would work one could abuse the easyxdm upload-rpc.html for phishing attacks, i.e. to display a login form that makes the user think the form can be trused.

An example:
Lets say twitter has the upload-rpc.html file at
easyxdm.twitter.com/upload-rpc.html
Then the hacker could abuse it and send emails like
easyxdm.twitter.com/upload-rpc.html?xdm_e=https%3A%2F%2Fwww.phishing.com&xdm_c=default7040&xdm_p=1 what would make any user think that this link is trusted since it comes from twitter.

Now to Anon’s question, which I think you have already answered indirectly in your response 4) to my question from above: would it be possible that the upload-rpc.html file displays a faked form (in our example it come from http://www.phishing.com) if the user clicks the twitter link? Let’s also assume that www.phishing.com returns a form that looks and feels like a real twitter login form. I that form would be displayed then easyxdm could be easily used in my example for phishing attacks.

From your responses to my questions I would understand that this is nothing to be concerned about, because per default easyxdm hides the iframe, so anything that comes from http://www.phishing.com and is inserted into the iframe is not visible. Anon is right – the alert is executed (I already mentioned that JavaScript is executed), but you will not be able to harm the user with that. I also understand that there is no way that the JavaScript in the iframe can access the cookies or session data from easyxdm.twitter.com since upload-rpc.html does not use this kind of data for the messaging.

my conclusion: easyxdm is resistent to my phishing-email example and that is exactly ehat i wanted to know.

Or am I wrong?