{"action":"created","issue":{"url":"https://api.github.com/repos/aramrami/OWASP-CSRFGuard/issues/43","labels_url":"https://api.github.com/repos/aramrami/OWASP-CSRFGuard/issues/43/labels{/name}","comments_url":"https://api.github.com/repos/aramrami/OWASP-CSRFGuard/issues/43/comments","events_url":"https://api.github.com/repos/aramrami/OWASP-CSRFGuard/issues/43/events","html_url":"https://github.com/aramrami/OWASP-CSRFGuard/issues/43","id":118372720,"number":43,"title":"CsrfGuard on IE9 and IE10 can change XMLHttpRequest like standard browser.","user":{"login":"langelov","id":8707213,"avatar_url":"https://avatars.githubusercontent.com/u/8707213?v=3","gravatar_id":"","url":"https://api.github.com/users/langelov","html_url":"https://github.com/langelov","followers_url":"https://api.github.com/users/langelov/followers","following_url":"https://api.github.com/users/langelov/following{/other_user}","gists_url":"https://api.github.com/users/langelov/gists{/gist_id}","starred_url":"https://api.github.com/users/langelov/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/langelov/subscriptions","organizations_url":"https://api.github.com/users/langelov/orgs","repos_url":"https://api.github.com/users/langelov/repos","events_url":"https://api.github.com/users/langelov/events{/privacy}","received_events_url":"https://api.github.com/users/langelov/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":3,"created_at":"2015-11-23T12:38:29Z","updated_at":"2015-11-24T10:11:12Z","closed_at":null,"body":"When hijacking XMLHttpRequest object there's special case for IE.\r\nThis special case is working for versions less than IE9, but don't properly hijack XHRv2 object in IE9 and IE10.\r\n    if (navigator.appName == \"Microsoft Internet Explorer\")\r\ncan be changed to \r\n    if (document.all && !document.addEventListener); // This catches everything lower than IE9\r\n\r\nThe problem was found during developing an Angular.js custom tag, which is loading template from external html with ajax call.\r\nAngular.js relies on \"onload\" event handler, and csrfguard is only providing \"onrequeststatechange\"."},"comment":{"url":"https://api.github.com/repos/aramrami/OWASP-CSRFGuard/issues/comments/159216208","html_url":"https://github.com/aramrami/OWASP-CSRFGuard/issues/43#issuecomment-159216208","issue_url":"https://api.github.com/repos/aramrami/OWASP-CSRFGuard/issues/43","id":159216208,"user":{"login":"40rn05lyv","id":1200215,"avatar_url":"https://avatars.githubusercontent.com/u/1200215?v=3","gravatar_id":"","url":"https://api.github.com/users/40rn05lyv","html_url":"https://github.com/40rn05lyv","followers_url":"https://api.github.com/users/40rn05lyv/followers","following_url":"https://api.github.com/users/40rn05lyv/following{/other_user}","gists_url":"https://api.github.com/users/40rn05lyv/gists{/gist_id}","starred_url":"https://api.github.com/users/40rn05lyv/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/40rn05lyv/subscriptions","organizations_url":"https://api.github.com/users/40rn05lyv/orgs","repos_url":"https://api.github.com/users/40rn05lyv/repos","events_url":"https://api.github.com/users/40rn05lyv/events{/privacy}","received_events_url":"https://api.github.com/users/40rn05lyv/received_events","type":"User","site_admin":false},"created_at":"2015-11-24T10:11:11Z","updated_at":"2015-11-24T10:11:11Z","body":"Actually, `onload` property was introduced in XHRv1, not XHRv2. Secondly, XHRv2 is supported only since IE10 (http://caniuse.com/#feat=xhr2). So, it's better to check for ability to use XMLHttpRequest.\r\n\r\nFrom\r\n\r\n```\r\n        if(navigator.appName == \"Microsoft Internet Explorer\") {\r\n            hijackExplorer();\r\n        } else {\r\n            hijackStandard();\r\n        }\r\n```\r\n\r\nto \r\n\r\n```\r\nfunction hasValidXHR() {\r\n    try { new window.XMLHttpRequest(); return true;} catch { return false; } \r\n}\r\n        if(navigator.appName == \"Microsoft Internet Explorer\" && !hasValidXHR()) {\r\n            hijackExplorer();\r\n        } else {\r\n            hijackStandard();\r\n        }\r\n\r\n```"}}