[
https://issues.apache.org/jira/browse/CB-1494?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13460485#comment-13460485
]
Matti Paksula commented on CB-1494:
-----------------------------------
_> re: matcher; what if the XFF has multiple comma-separated addresses, with no
spaces between them? _
You're right, fixed that now.
About XSS: it's not possible to inject through remoteAddress, because the link
won't establish
(https://github.com/apache/incubator-cordova-weinre/blob/master/weinre.server/lib/channelManager.coffee#L80)
BUT even if that would be possible, it's eliminated already in the view layer:
https://github.com/apache/incubator-cordova-weinre/blob/master/weinre.web/modules/weinre/client/RemotePanel.coffee#L161
where key.escapeHTML() is used.
> Supports running server behind a proxy, such as Heroku Cedar
> ------------------------------------------------------------
>
> Key: CB-1494
> URL: https://issues.apache.org/jira/browse/CB-1494
> Project: Apache Cordova
> Issue Type: New Feature
> Components: weinre
> Reporter: Patrick Mueller
> Assignee: Patrick Mueller
>
> created for https://github.com/apache/incubator-cordova-weinre/pull/10
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators
For more information on JIRA, see: http://www.atlassian.com/software/jira
