CVE-2016-10549

@@ -44,6 +44,9 @@ module.exports = function(sails) {
      */
     initialize: function(cb) {
 
+      // Declare an array to hold info about unsafely-configured routes.
+      var unsafeRoutes = [];
+
       // Once it's time to bind shadow routes, get to bindin'.
       sails.on('router:before', function () {
         // (TODO: consider changing this ^^ to `sails.after()` for consistency)
@@ -112,10 +115,55 @@ module.exports = function(sails) {
               sails.log.warn('Invalid CORS settings for route '+route);
             }
 
+            // If the global CORS defaults are not overly permissive, check this individual route's settings.
+            if (sails.config.cors.allRoutes === false || sails.config.cors.origin !== '*' || sails.config.cors.credentials === false) {
+              var routeCorsConfig = _.defaults(optionsRouteConfigs[path][verb || 'default'], sails.config.cors);
+              // If they are too permissive, add the route to a list of unsafe routes to warn the user about
+              // when running in the production environment.
+              if (routeCorsConfig.origin === '*' && routeCorsConfig.credentials === true) {
+                unsafeRoutes.push((verb ? (verb + ' ') : '') + path);
+              }
+            }
+
           }
 
         });
 
+        // Log a warning if your default CORS settings are super permissive in the production environment.
+        if (sails.config.environment === 'production') {
+          // If the global CORS defaults are permissive, log a warning about that.
+          if (
+            sails.config.cors.allRoutes === true &&
+            sails.config.cors.origin === '*' &&
+            sails.config.cors.credentials === true
+          ) {
+          sails.log.error('\n' +
+                         '=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=\n' +
+                         'WARNING: You currently have your default CORS settings configured to allow\n' +
+                         'all requests from all origins, with credentials.  This may leave your app\n' +
+                         'open to attack by third-party sites!  Consider making your `origins` setting\n' +
+                         'more restrictive or setting `credentials` to false, or else make certain that\n' +
+                         'none of your routes perform sensitive actions or reveal secure information.\n' +
+                         '=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=\n');
+          }
+          // Otherwise log a warning mentioning the particular routes that are too permissive.
+          else if (unsafeRoutes.length) {
+            sails.log.error('\n' +
+                           '=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=\n' +
+                           'WARNING: You currently have CORS settings on the following routes configured\n' +
+                           'to allow all requests from all origins, with credentials:\n\n' + unsafeRoutes.join('\n') + '\n\n' +
+                           'This may leave these routes open to attack by third-party sites!  Consider\n'+
+                           'making the `origins` settings more restrictive or setting `credentials` to\n' +
+                           'false, or else make certain that none of these routes perform sensitive\n' +
+                           'actions or reveal secure information.\n' +
+                           '=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=\n'
+                           );
+          }
+        }
+
+
+
+
         _.each(optionsRouteConfigs, function(config, path) {
           sails.router.bind('options '+path, prepareSendHeaders(config, true), null, {_middlewareType: 'CORS HOOK: preflight'});
         });