From 6167d1584ab76cdd782529e2ed7a8a50a46abb4c Mon Sep 17 00:00:00 2001
From: Shannon <sdeminick@gmail.com>
Date: Tue, 15 Jul 2014 11:37:31 +1000
Subject: [PATCH] Fixes an xss vulnerability

---
 .../umbraco/developer/Packages/proxy.htm      | 54 +++++++++++++++++--
 1 file changed, 51 insertions(+), 3 deletions(-)
diff --git a/src/Umbraco.Web.UI/umbraco/developer/Packages/proxy.htm b/src/Umbraco.Web.UI/umbraco/developer/Packages/proxy.htm
index 4d89a2c063..b65ea2d674 100644
--- a/src/Umbraco.Web.UI/umbraco/developer/Packages/proxy.htm
+++ b/src/Umbraco.Web.UI/umbraco/developer/Packages/proxy.htm
@@ -5,9 +5,57 @@
 </head>
 <body>
 
-<script type="text/javascript">
-  top.right.document.location = window.location.search.substring(1);
-</script>
+    <script type="text/javascript">
+        
+        //This is a genius way of parsing a uri
+        //https://gist.github.com/jlong/2428561
+
+        try {
+            var parser = document.createElement('a');
+            parser.href = window.location.search.substring(1);
+
+            // => "http:"
+            if (!parser.protocol || (parser.protocol.toLowerCase() != "http:" && parser.protocol.toLowerCase() != "https:")) {
+                throw "invalid protocol";
+            };
+
+            // => "example.com"
+            if (!parser.hostname || parser.hostname == "") {
+                throw "invalid hostname";
+            }
+            
+            //parser.port;     // => "3000"
+
+            // => "/pathname/"
+            if (!parser.pathname || ((parser.pathname.length - parser.pathname.indexOf("/developer/packages/installer.aspx")) != "/developer/packages/installer.aspx".length))
+            {
+                throw "invalid pathname";
+            }
+            
+            // => "?search=test"
+            if (!parser.search || parser.search.indexOf("?repoGuid") != 0) {
+                throw "invalid search";
+            }
+            
+            // => "#hash"
+            if (parser.hash && parser.hash != "") {
+                throw "invalid hash";
+            }   
+
+            //parser.host;     // => "example.com:3000"
+
+            if (!top.right) {
+                throw "invalid document";
+            }
+
+            top.right.document.location = window.location.search.substring(1);
+
+        } catch (e) {
+            alert(e);
+        }
+
+        
+    </script>
 
 </body>
 </html>
