FIX for com.au (long multipart domain suffix)

4e55a64f · Sebastien Cante · Wandenberg Peixoto · c662fdbd · 4e55a64f · 4e55a64f
Commit 4e55a64f authored Sep 28, 2012 by Sebastien Cante Committed by Wandenberg Peixoto Nov 20, 2012
4 changed files
--- a/docs/examples/forever_iframe.textile
+++ b/docs/examples/forever_iframe.textile
@@ -25,7 +25,7 @@ Create a html page with the content on **Client** part, access it from browser a
        set $push_stream_channels_path              $1;

        # header to be sent when receiving new subscriber connection
-        push_stream_header_template                 "<html><head><meta http-equiv=\"Content-Type\" content=\"text/html; charset=utf-8\">\r\n<meta http-equiv=\"Cache-Control\" content=\"no-store\">\r\n<meta http-equiv=\"Cache-Control\" content=\"no-cache\">\r\n<meta http-equiv=\"Pragma\" content=\"no-cache\">\r\n<meta http-equiv=\"Expires\" content=\"Thu, 1 Jan 1970 00:00:00 GMT\">\r\n<script type=\"text/javascript\">\r\nwindow.onError = null;\r\ntry{ document.domain = (window.location.hostname.match(/^(\d{1,3}\.){3}\d{1,3}$/)) ? window.location.hostname : window.location.hostname.split('.').slice(-2).join('.');}catch(e){}\r\nparent.PushStream.register(this);\r\n</script>\r\n</head>\r\n<body>";
+        push_stream_header_template                 "<html><head><meta http-equiv=\"Content-Type\" content=\"text/html; charset=utf-8\">\r\n<meta http-equiv=\"Cache-Control\" content=\"no-store\">\r\n<meta http-equiv=\"Cache-Control\" content=\"no-cache\">\r\n<meta http-equiv=\"Pragma\" content=\"no-cache\">\r\n<meta http-equiv=\"Expires\" content=\"Thu, 1 Jan 1970 00:00:00 GMT\">\r\n<script type=\"text/javascript\">\r\nwindow.onError = null;\r\ntry{ document.domain = (window.location.hostname.match(/^(\d{1,3}\.){3}\d{1,3}$/)) ? window.location.hostname : window.location.hostname.split('.').slice(-1 * Math.max(window.location.hostname.split('.').length - 1, 2)).join('.');}catch(e){}\r\nparent.PushStream.register(this);\r\n</script>\r\n</head>\r\n<body>";
        # message template
        push_stream_message_template                "<script>p(~id~,'~channel~','~text~');</script>";
        # footer to be sent when finishing subscriber connection
@@ -97,7 +97,7 @@ If needed you can change this behavior changing the javascript usage, like the e
        set $push_stream_channels_path              $arg_channels;

        # header to be sent when receiving new subscriber connection
-        push_stream_header_template                 "<html><head><meta http-equiv=\"Content-Type\" content=\"text/html; charset=utf-8\">\r\n<meta http-equiv=\"Cache-Control\" content=\"no-store\">\r\n<meta http-equiv=\"Cache-Control\" content=\"no-cache\">\r\n<meta http-equiv=\"Pragma\" content=\"no-cache\">\r\n<meta http-equiv=\"Expires\" content=\"Thu, 1 Jan 1970 00:00:00 GMT\">\r\n<script type=\"text/javascript\">\r\nwindow.onError = null;\r\ntry{ document.domain = (window.location.hostname.match(/^(\d{1,3}\.){3}\d{1,3}$/)) ? window.location.hostname : window.location.hostname.split('.').slice(-2).join('.');}catch(e){}\r\nparent.PushStream.register(this);\r\n</script>\r\n</head>\r\n<body>";
+        push_stream_header_template                 "<html><head><meta http-equiv=\"Content-Type\" content=\"text/html; charset=utf-8\">\r\n<meta http-equiv=\"Cache-Control\" content=\"no-store\">\r\n<meta http-equiv=\"Cache-Control\" content=\"no-cache\">\r\n<meta http-equiv=\"Pragma\" content=\"no-cache\">\r\n<meta http-equiv=\"Expires\" content=\"Thu, 1 Jan 1970 00:00:00 GMT\">\r\n<script type=\"text/javascript\">\r\nwindow.onError = null;\r\ntry{ document.domain = (window.location.hostname.match(/^(\d{1,3}\.){3}\d{1,3}$/)) ? window.location.hostname : window.location.hostname.split('.').slice(-1 * Math.max(window.location.hostname.split('.').length - 1, 2)).join('.');}catch(e){}\r\nparent.PushStream.register(this);\r\n</script>\r\n</head>\r\n<body>";
        # message template
        push_stream_message_template                "<script>p(~id~,'~channel~','~text~');</script>";
        # footer to be sent when finishing subscriber connection

--- a/misc/js/pushstream.js
+++ b/misc/js/pushstream.js
@@ -364,8 +364,17 @@
  };

  var extract_xss_domain = function(domain) {
-    // if domain is a ip address return it, else return the last two parts of it
-    return (domain.match(/^(\d{1,3}\.){3}\d{1,3}$/)) ? domain : domain.split('.').slice(-2).join('.');
+    // if domain is an ip address return it, else return ate least the last two parts of it
+    if (domain.match(/^(\d{1,3}\.){3}\d{1,3}$/)) {
+      return domain;
+    }
+
+    var domainParts = domain.split('.');
+    // window.domain="com.au" fails (illegal) on firefox we need to keep more than 2 parts in this case
+    // always keep 2 domain parts , if 3 provided cut to 2, if 4 cut to 3.
+    var keepNumber = Math.max(domainParts.length - 1, 2);
+
+    return domainParts.slice(-1 * keepNumber).join('.');
  };

  var linker = function(method, instance) {

--- a/misc/nginx.conf
+++ b/misc/nginx.conf
@@ -100,7 +100,7 @@ http {
            set $push_stream_channels_path              $1;

            # header to be sent when receiving new subscriber connection
-            push_stream_header_template                 "<html><head><meta http-equiv=\"Content-Type\" content=\"text/html; charset=utf-8\">\r\n<meta http-equiv=\"Cache-Control\" content=\"no-store\">\r\n<meta http-equiv=\"Cache-Control\" content=\"no-cache\">\r\n<meta http-equiv=\"Pragma\" content=\"no-cache\">\r\n<meta http-equiv=\"Expires\" content=\"Thu, 1 Jan 1970 00:00:00 GMT\">\r\n<script type=\"text/javascript\">\r\nwindow.onError = null;\r\ntry{ document.domain = (window.location.hostname.match(/^(\d{1,3}\.){3}\d{1,3}$/)) ? window.location.hostname : window.location.hostname.split('.').slice(-2).join('.');}catch(e){}\r\nparent.PushStream.register(this);\r\n</script>\r\n</head>\r\n<body>";
+            push_stream_header_template                 "<html><head><meta http-equiv=\"Content-Type\" content=\"text/html; charset=utf-8\">\r\n<meta http-equiv=\"Cache-Control\" content=\"no-store\">\r\n<meta http-equiv=\"Cache-Control\" content=\"no-cache\">\r\n<meta http-equiv=\"Pragma\" content=\"no-cache\">\r\n<meta http-equiv=\"Expires\" content=\"Thu, 1 Jan 1970 00:00:00 GMT\">\r\n<script type=\"text/javascript\">\r\nwindow.onError = null;\r\ntry{ document.domain = (window.location.hostname.match(/^(\d{1,3}\.){3}\d{1,3}$/)) ? window.location.hostname : window.location.hostname.split('.').slice(-1 * Math.max(window.location.hostname.split('.').length - 1, 2)).join('.');}catch(e){}\r\nparent.PushStream.register(this);\r\n</script>\r\n</head>\r\n<body>";
            # message template
            #push_stream_message_template                "<script>p(~id~,'~channel~','~text~','~event-id~');</script>";
            push_stream_message_template                "<script>p(~id~,'~channel~','~text~');</script>";

--- a/test/spec/javascripts/PushStreamUtilsSpec.js
+++ b/test/spec/javascripts/PushStreamUtilsSpec.js
@@ -11,6 +11,24 @@ describe("PushStreamUtils", function() {
  beforeEach(function() {
  });

+  describe("when extract xss domain", function() {
+    it("should return the ip address when domain is only an ip", function() {
+      expect(extract_xss_domain("201.10.32.52")).toBe("201.10.32.52");
+    });
+
+    it("should return the full domain when it has only two parts", function() {
+      expect(extract_xss_domain("domain.com")).toBe("domain.com");
+    });
+
+    it("should return the last two parts when domain has three parts", function() {
+      expect(extract_xss_domain("example.domain.com")).toBe("domain.com");
+    });
+
+    it("should return all parts minus the first one when domain has more than three parts", function() {
+      expect(extract_xss_domain("another.example.domain.com")).toBe("example.domain.com");
+    });
+  });
+
  describe("when parsing a message", function() {
    it("should accept a simple string as text", function() {
      var message = parseMessage('{"id":31,"channel":"54x19","text":"some simple string"}', jsonKeys);