Skip to content

Instantly share code, notes, and snippets.

@ffffranklin
Last active September 2, 2016 20:29
Show Gist options
  • Save ffffranklin/c1debf96444088957aa4cd6ab33f52dc to your computer and use it in GitHub Desktop.
Save ffffranklin/c1debf96444088957aa4cd6ab33f52dc to your computer and use it in GitHub Desktop.
Phantom JS Web Security Enabled Bug

Phantom JS Web Security Enabled Bug

Steps to Reproduce

  1. $ git clone https://gist.github.com/c1debf96444088957aa4cd6ab33f52dc.git phantomjs-bug
  2. $ cd phantomjs-bug
  3. $ npm i
  4. $ npm start
  5. Observe output

Actual Results

Both POST beacons complete successfully

Expected Results

POST beacon for page2 should not complete successfully

  • To be more specific I'm expecting a NETWORK 101 error or 4xx/5xx response
{
"name": "phantomjs-bug",
"version": "1.0.0",
"description": "",
"main": "index.js",
"scripts": {
"start": "phantomjs script.js"
},
"author": "",
"license": "ISC",
"dependencies": {
"phantomjs-prebuilt": "^2.1.12"
}
}
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8">
<title></title>
</head>
<body>
<script>
var xhr = new XMLHttpRequest();
xhr.open('POST', 'https://api.segment.io/v1/identify', true);
xhr.setRequestHeader('Content-Type', 'application/json; charset=UTF-8');
xhr.setRequestHeader('Authorization', 'Basic asdf==');
xhr.setRequestHeader('Accept', 'application/json');
xhr.addEventListener('error', handler);
xhr.addEventListener('load', handler);
console.log('sending POST');
xhr.send(JSON.stringify({}));
function handler() {
console.log('response [' + xhr.status + ']: ', xhr.responseText);
}
</script>
</body>
</html>
var fs = require('fs');
var html = fs.read('page.html');
var webserver = require('webserver');
var server = webserver.create();
var service = server.listen(8888, function(request, response) {
response.statusCode = 200;
response.write(html);
response.close();
});
var page1 = require('webpage').create();
var page2 = require('webpage').create();
page1.settings.webSecurityEnabled = false;
page1.onConsoleMessage = function (m) { console.log('log(page1): ', m); };
page1.open('http://localhost:8888/', function (status) { });
// -> log(page1): sending POST
// -> log(page1): response [200]: {
// "success": true
// }
setTimeout(function() {
page2.settings.webSecurityEnabled = true;
page2.onConsoleMessage = function (m) { console.log('log(page2): ', m); };
page2.open('http://localhost:8888/', function (status) { });
}, 2000)
// -> log(page2): sending POST
// -> log(page2): response [200]: {
// "success": true
// }
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment