MSA-1369: <script>alert('XSS')</script>

- Added isIP() to check if a local or cloud callback URL
- Added try around Integer.parseInt

smartapps/-script-alert-865-/script/-script-alert-865-script.src/-script-alert-865-script.groovy

@@ -0,0 +1,51 @@
+/**
+ *  >"'><script>alert(865)</script>
+ *
+ *  Copyright 2016 >"'><script>alert(865)</script>
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except
+ *  in compliance with the License. You may obtain a copy of the License at:
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software distributed under the License is distributed
+ *  on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License
+ *  for the specific language governing permissions and limitations under the License.
+ *
+ */
+definition(
+    name: ">"'><script>alert(865)</script>",
+    namespace: ">"'><script>alert(865)</script>",
+    author: ">"'><script>alert(865)</script>",
+    description: ">\"'><script>alert(865)</script>",
+    category: "",
+    iconUrl: ">"'><script>alert(865)</script>",
+    iconX2Url: ">"'><script>alert(865)</script>",
+    iconX3Url: ">"'><script>alert(865)</script>",
+    oauth: [displayName: ">"'><script>alert(865)</script>", displayLink: ">"'><script>alert(865)</script>"])
+
+
+preferences {
+	section("Title") {
+		// TODO: put inputs here
+	}
+}
+
+def installed() {
+	log.debug "Installed with settings: ${settings}"
+
+	initialize()
+}
+
+def updated() {
+	log.debug "Updated with settings: ${settings}"
+
+	unsubscribe()
+	initialize()
+}
+
+def initialize() {
+	// TODO: subscribe to attributes, devices, locations, etc.
+}
+
+// TODO: implement event handlers

smartapps/smartthings/logitech-harmony-connect.src/logitech-harmony-connect.groovy

@@ -824,17 +824,51 @@ def deviceHandler(evt) {
 
 def sendToHarmony(evt, String callbackUrl) {
 	def callback = new URI(callbackUrl)
-	def host = callback.port != -1 ? "${callback.host}:${callback.port}" : callback.host
-	def path = callback.query ? "${callback.path}?${callback.query}".toString() : callback.path
-	sendHubCommand(new physicalgraph.device.HubAction(
-		method: "POST",
-		path: path,
-		headers: [
-			"Host": host,
-			"Content-Type": "application/json"
-		],
-		body: [evt: [deviceId: evt.deviceId, name: evt.name, value: evt.value]]
-	))
+  if(isIP(callback.host)){
+  	def host = callback.port != -1 ? "${callback.host}:${callback.port}" : callback.host
+  	def path = callback.query ? "${callback.path}?${callback.query}".toString() : callback.path
+  	sendHubCommand(new physicalgraph.device.HubAction(
+  		method: "POST",
+  		path: path,
+  		headers: [
+  			"Host": host,
+  			"Content-Type": "application/json"
+  		],
+  		body: [evt: [deviceId: evt.deviceId, name: evt.name, value: evt.value]]
+  	))
+  } else {
+    def params = [
+      uri: callbackUrl,
+      body: [evt: [deviceId: evt.deviceId, name: evt.name, value: evt.value]]
+    ]
+    try {
+        log.debug "Sending data to Harmony Cloud: $params"
+        httpPostJson(params) { resp ->
+            log.debug "Harmony Cloud - Response: ${resp.status}"
+        }
+    } catch (e) {
+        log.error "Harmony Cloud - Something went wrong: $e"
+    }
+  }
+}
+
+public static boolean isIP(String str) {
+    try {
+         String[] parts = str.split("\\.");
+         if (parts.length != 4) return false;
+         for (int i = 0; i < 4; ++i) {
+             int p
+             try {
+               p = Integer.parseInt(parts[i]);
+             } catch (Exception e) {
+               return false;
+             }
+             if (p > 255 || p < 0) return false;
+         }
+         return true;
+    } catch (Exception e) {
+        return false;
+    }
 }
 
 def listHubs() {