DOM Exception 18 in Awesomium

Question

DOM Exception 18 in Awesomium

I have a webpage being loaded from the local file system and rendered using awesomium, the page is using Angular.jsto render part of the page. However, I have a problem with part of my Angular controller generating a Dom Exception 18:

angular-1.0.0rc10.js @ line 5349 Error: SECURITY_ERR: DOM Exception 18

It seems this exception is caused by the presence of this code at the end of my Angular controller:

$http({method: 'GET', url: 'http://placeholdermetaserver.appspot.com/list?format=json&game=Heist'})
.success(function(data)
{
    //Do stuff with data
});

Oddly enough everything is just fine if I use a straight XMLHttpRequest instead of the Angular $http object:

var request = new XMLHttpRequest();
request.onload = function() {
    //Do stuff with data
};
request.open("GET", "http://placeholdermetaserver.appspot.com/list?format=json&game=Heist", true);

This exception is not generated when I simply load this page in chrome (off the local file system, same as awesomium).

What could cause this and how can I fix it?

angularjs
awesomium

Answer 1

The $http service includes some Cross Site Request Forgery (XSRF) countermeasures. I'm not especially familiar with Awesomium, so I'm not sure what security features it implements, but I'd consult the documentation (both of Awesomium and AngularJS) for more info.

http://docs.angularjs.org/api/angular.module.ng.$http

From the perspective of your server, this is prone to the textbook XSRF img tag attack if you ever send a GET request like:

"http://myapp.com/doSomething/somegame/12345"

From the perspective of your client, let's say you make a request like:

"http://myapp.com/doSomething/somegame/" + someId

A clever hacker might coax someId to be:

"@123.45.56.689/myEvilFakeJson.json"

In which case the request isn't made to your server, but instead some other one. If you hard code the location of the request or are careful with sanitizing input, it probably won't be that much of a risk.