{"action":"created","issue":{"url":"https://api.github.com/repos/aramrami/OWASP-CSRFGuard/issues/85","repository_url":"https://api.github.com/repos/aramrami/OWASP-CSRFGuard","labels_url":"https://api.github.com/repos/aramrami/OWASP-CSRFGuard/issues/85/labels{/name}","comments_url":"https://api.github.com/repos/aramrami/OWASP-CSRFGuard/issues/85/comments","events_url":"https://api.github.com/repos/aramrami/OWASP-CSRFGuard/issues/85/events","html_url":"https://github.com/aramrami/OWASP-CSRFGuard/issues/85","id":270362128,"number":85,"title":"String prototype override issues","user":{"login":"Koeroesi86","id":15781967,"avatar_url":"https://avatars0.githubusercontent.com/u/15781967?v=4","gravatar_id":"","url":"https://api.github.com/users/Koeroesi86","html_url":"https://github.com/Koeroesi86","followers_url":"https://api.github.com/users/Koeroesi86/followers","following_url":"https://api.github.com/users/Koeroesi86/following{/other_user}","gists_url":"https://api.github.com/users/Koeroesi86/gists{/gist_id}","starred_url":"https://api.github.com/users/Koeroesi86/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Koeroesi86/subscriptions","organizations_url":"https://api.github.com/users/Koeroesi86/orgs","repos_url":"https://api.github.com/users/Koeroesi86/repos","events_url":"https://api.github.com/users/Koeroesi86/events{/privacy}","received_events_url":"https://api.github.com/users/Koeroesi86/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2017-11-01T16:13:18Z","updated_at":"2017-11-01T16:57:47Z","closed_at":null,"author_association":"NONE","body":"In csrfguard.js there is a String.prototype.endsWith and String.prototype.startsWith which overrides the default functionality in browsers. The endsWith although carries a huge potential of failure as it tries to execute the string as a regex as follows:\r\n\r\n`String.prototype.endsWith = function(suffix) {\r\n\treturn this.match(suffix+\"$\") == suffix;\r\n};`\r\n\r\nThis makes a lot of calls failing on this function, the closest fix would be (if even this prototype is needed):\r\n\r\n`String.prototype.endsWith = function(suffix) {\r\n\treturn this.substr(-suffix.length) === suffix;\r\n};`"},"comment":{"url":"https://api.github.com/repos/aramrami/OWASP-CSRFGuard/issues/comments/341168443","html_url":"https://github.com/aramrami/OWASP-CSRFGuard/issues/85#issuecomment-341168443","issue_url":"https://api.github.com/repos/aramrami/OWASP-CSRFGuard/issues/85","id":341168443,"user":{"login":"briandipalma","id":1597820,"avatar_url":"https://avatars1.githubusercontent.com/u/1597820?v=4","gravatar_id":"","url":"https://api.github.com/users/briandipalma","html_url":"https://github.com/briandipalma","followers_url":"https://api.github.com/users/briandipalma/followers","following_url":"https://api.github.com/users/briandipalma/following{/other_user}","gists_url":"https://api.github.com/users/briandipalma/gists{/gist_id}","starred_url":"https://api.github.com/users/briandipalma/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/briandipalma/subscriptions","organizations_url":"https://api.github.com/users/briandipalma/orgs","repos_url":"https://api.github.com/users/briandipalma/repos","events_url":"https://api.github.com/users/briandipalma/events{/privacy}","received_events_url":"https://api.github.com/users/briandipalma/received_events","type":"User","site_admin":false},"created_at":"2017-11-01T16:57:47Z","updated_at":"2017-11-01T16:57:47Z","author_association":"NONE","body":"I guess using the polyfill from MDN is the safest approach\r\n\r\n```javascript\r\nif (!String.prototype.endsWith)\r\n  String.prototype.endsWith = function(searchStr, Position) {\r\n      // This works much better than >= because\r\n      // it compensates for NaN:\r\n      if (!(Position < this.length))\r\n        Position = this.length;\r\n      else\r\n        Position |= 0; // round position\r\n      return this.substr(Position - searchStr.length,\r\n                         searchStr.length) === searchStr;\r\n  };\r\n```\r\n\r\n?"}}
{"actor":{"display_login":"briandipalma"}}