frodovdr
/
node-red
mirror of https://github.com/node-red/node-red.git
1
0
Fork 0
Code Issues Releases Wiki Activity

Fix XSS issues in library ui code

This commit is contained in:
Nick O'Leary 2019-02-06 22:25:25 +00:00
parent 37b3601c47
commit a301bf8bf5
No known key found for this signature in database
GPG Key ID: 4F2157149161A6C9
1 changed files with 7 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
packages/node_modules/@node-red/editor-client/src/js/ui/library.js vendored
View File

@ -45,7 +45,7 @@ RED.library = (function() {
a = document.createElement("a"); a = document.createElement("a");
a.href="#"; a.href="#";
var label = i.replace(/^@.*\//,"").replace(/^node-red-contrib-/,"").replace(/^node-red-node-/,"").replace(/-/," ").replace(/_/," "); var label = i.replace(/^@.*\//,"").replace(/^node-red-contrib-/,"").replace(/^node-red-node-/,"").replace(/-/," ").replace(/_/," ");
a.innerHTML = label; a.innerText = label;
li.appendChild(a); li.appendChild(a);
li.appendChild(buildMenu(data.d[i],root+(root!==""?"/":"")+i)); li.appendChild(buildMenu(data.d[i],root+(root!==""?"/":"")+i));
ul.appendChild(li); ul.appendChild(li);
@ -58,7 +58,7 @@ RED.library = (function() {
li = document.createElement("li"); li = document.createElement("li");
a = document.createElement("a"); a = document.createElement("a");
a.href="#"; a.href="#";
a.innerHTML = data.f[i]; a.innerText = data.f[i];
a.flowName = root+(root!==""?"/":"")+data.f[i]; a.flowName = root+(root!==""?"/":"")+data.f[i];
a.onclick = function() { a.onclick = function() {
$.get('library/flows/'+this.flowName, function(data) { $.get('library/flows/'+this.flowName, function(data) {
@ -125,8 +125,8 @@ RED.library = (function() {
li.onclick = (function () { li.onclick = (function () {
var dirName = v; var dirName = v;
return function(e) { return function(e) {
var bcli = $('<li class="active"><span class="divider">/</span> <a href="#">'+dirName+'</a></li>'); var bcli = $('<li class="active"><span class="divider">/</span> </li>');
$("a",bcli).click(function(e) { $('<a href="#"></a>').text(dirName).appendTo(bcli).click(function(e) {
$(this).parent().nextAll().remove(); $(this).parent().nextAll().remove();
$.getJSON("library/"+options.url+root+dirName,function(data) { $.getJSON("library/"+options.url+root+dirName,function(data) {
$("#node-select-library").children().first().replaceWith(buildFileList(root+dirName+"/",data)); $("#node-select-library").children().first().replaceWith(buildFileList(root+dirName+"/",data));
@ -141,12 +141,13 @@ RED.library = (function() {
}); });
} }
})(); })();
li.innerHTML = '<i class="fa fa-folder"></i> '+v+"</i>"; $('<i class="fa fa-folder"></i>').appendTo(li);
$('<span>').text(" "+v).appendTo(li);
ul.appendChild(li); ul.appendChild(li);
} else { } else {
// file // file
li = buildFileListItem(v); li = buildFileListItem(v);
li.innerHTML = v.name; li.innerText = v.name;
li.onclick = (function() { li.onclick = (function() {
var item = v; var item = v;
return function(e) { return function(e) {