CVE-2022-25146

@@ -12,10 +12,6 @@
  * details.
  */
 
-const DEFAULT_INIT = {
-	credentials: 'include',
-};
-
 /**
  * Fetches a resource. A thin wrapper around ES6 Fetch API, with standardized
  * default configuration.
@@ -26,19 +22,26 @@ const DEFAULT_INIT = {
  */
 
 export default function defaultFetch(resource, init = {}) {
-	const headers = new Headers({'x-csrf-token': Liferay.authToken});
+	let resourceLocation = resource.url ? resource.url : resource.toString();
+
+	if (resourceLocation.startsWith('/')) {
+		resourceLocation = window.location.origin + resourceLocation;
+	}
+
+	const resourceURL = new URL(resourceLocation);
+
+	const headers = new Headers({});
+	const config = {};
+
+	if (resourceURL.origin === window.location.origin) {
+		headers.set('x-csrf-token', Liferay.authToken);
+		config.credentials = 'include';
+	}
 
 	new Headers(init.headers || {}).forEach((value, key) => {
 		headers.set(key, value);
 	});
 
-	const mergedInit = {
-		...DEFAULT_INIT,
-		...init,
-	};
-
-	mergedInit.headers = headers;
-
 	// eslint-disable-next-line @liferay/portal/no-global-fetch
-	return fetch(resource, mergedInit);
+	return fetch(resource, {...config, ...init, headers});
 }

@@ -120,18 +120,22 @@ function receiveMessage(event) {
 
 					// TODO: more validation here
 
-					const resource = data.resource;
+					let resource = data.resource;
+
+					if (resource.startsWith('/o/')) {
+						resource = window.location.origin + resource;
+					}
+
+					const resourceUrl = new URL(resource);
 
 					// LPS-145277: Prevent requests to other origins
 
-					if (
-						!(
-							resource.startsWith(window.location.origin) ||
-							resource.startsWith('/o/')
-						)
-					) {
+					if (resourceUrl.origin !== window.location.origin) {
 						postMessage(source, {
 							appID,
+							error: new Error(
+								'Invalid resource: Resource must come from permitted origin.'
+							),
 							kind: 'fetch:reject',
 							requestID,
 						});

@@ -278,6 +278,9 @@ describe('remote-app-web', () => {
 
 			expect(receiveMessage.mock.calls[0][0].data).toEqual({
 				appID: 'some UUID',
+				error: new Error(
+					'Invalid resource: Resource must come from permitted origin.'
+				),
 				kind: 'fetch:reject',
 				protocol: 'com.liferay.remote.app.protocol',
 				requestID: undefined,