bitwarden/web
1
0
Fork 0
mirror of https://github.com/bitwarden/web synced 2025-12-11 05:43:16 +00:00
Code Issues Releases Wiki Activity

limit duo connector hosts to duo-owned domains (#1283)

Browse Source
This commit is contained in:
Kyle Spearrin
2021-11-09 12:17:30 -05:00
committed by GitHub
parent 83fed7d66f
commit 9061af54bf
1 changed files with 6 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
src/connectors/duo.ts
View File

@@ -12,6 +12,12 @@ document.addEventListener('DOMContentLoaded', event => {
const hostParam = getQsParam('host'); const hostParam = getQsParam('host');
const requestParam = getQsParam('request'); const requestParam = getQsParam('request');
var hostUrl = new URL('https://' + hostParam);
if (!hostUrl.hostname.endsWith('.duosecurity.com') && !hostUrl.hostname.endsWith('.duofederal.com')) {
return;
}
DuoWebSDK.init({ DuoWebSDK.init({
iframe: 'duo_iframe', iframe: 'duo_iframe',
host: hostParam, host: hostParam,