respond-proxy.html has XSS issue

[zmmbreeze]

For example: http://yourcdn.com/respond-proxy.html?url=javascript:alert(19890611520);&css=http://yourcdn.com/test.css

Code: https://github.com/scottjehl/Respond/blob/master/cross-domain/respond-proxy.html#L90

[matthijsmelissen]

Confirmed.

[ljharb]

@scottjehl any update on this?

[scottjehl]

So, deprecating the cross-domain proxy is definitely the first thing I'd like to do. A server proxy, while annoying, is likely the better way to handle this situation. I hope you agree.

The proxy has been deprecated in the readme since October, so I think a new point release should remove it.

[lecajer]

I added the following in respond-proxy.html#L87 in order to have a minimal protection.

// XSS protection
if(domain.toLowerCase().indexOf('javascript') !== -1) {
    domain = null;
}

Not sure if it is possible to pass through.

[matthijsmelissen]

Can we not do whitelisting, i.e. only accept URLs starting with http:// and https://?