[vulnerability][errorReport] GET errorReport.json request with 404 response

[t2ym]

[vulnerability][errorReport] GET errorReport.json request with 404 response

Root Cause

• errorReportService.js does not handle GET requests and responds with 404 Not Found

Vulnerability

In the document

{
  let iframe = document.createElement('iframe');
  iframe.src = '/components/thin-hook/demo/errorReport.json';
  document.body.appendChild(iframe);
  iframe.contentWindow.caches;
}

Fix

• GET errorReport.json to respond with 307 about:blank

diff --git a/demo/errorReportService.js b/demo/errorReportService.js
index b9e6a262..64390187 100644
--- a/demo/errorReportService.js
+++ b/demo/errorReportService.js
@@ -28,3 +28,6 @@ app.post('/errorReport.json', function(req, res) {
   "severity": "permissive"
 }`);
 });
+app.all('*', (req, res) => {
+  res.redirect(307, 'about:blank');
+});