Skip to content

Commit

Permalink
fix(chore): prevent possible xss
Browse files Browse the repository at this point in the history 
In some edge cases a class or iconname, given via settings, might get such values out of uncontrolled input.
For such cases we need to dequote the values.
  • Loading branch information
@lubber-de
lubber-de authored Aug 10, 2022
1 parent 89653dc commit 1513222
Show file tree
Hide file tree
Showing 4 changed files with 36 additions and 23 deletions.
33 changes: 18 additions & 15 deletions src/definitions/modules/dropdown.js
View file
Original file line number Diff line number Diff line change
Expand Up @@ -4257,7 +4257,8 @@ $.fn.dropdown.settings.templates = {
var
placeholder = select.placeholder || false,
html = '',
escape = $.fn.dropdown.settings.templates.escape
escape = $.fn.dropdown.settings.templates.escape,
deQuote = $.fn.dropdown.settings.templates.deQuote
;
html += '<i class="dropdown icon"></i>';
if(placeholder) {
Expand All @@ -4266,7 +4267,7 @@ $.fn.dropdown.settings.templates = {
else {
html += '<div class="text"></div>';
}
html += '<div class="'+className.menu+'">';
html += '<div class="'+deQuote(className.menu)+'">';
html += $.fn.dropdown.settings.templates.menu(select, fields, preserveHTML,className);
html += '</div>';
return html;
Expand Down Expand Up @@ -4304,27 +4305,27 @@ $.fn.dropdown.settings.templates = {
: '',
hasDescription = (escape(option[fields.description] || '', preserveHTML) != '')
;
html += '<div class="'+ maybeActionable + maybeDisabled + maybeDescriptionVertical + (option[fields.class] ? deQuote(option[fields.class]) : className.item)+'" data-value="' + deQuote(option[fields.value],true) + '"' + maybeText + '>';
html += '<div class="'+ deQuote(maybeActionable + maybeDisabled + maybeDescriptionVertical + (option[fields.class] ? option[fields.class] : className.item))+'" data-value="' + deQuote(option[fields.value],true) + '"' + maybeText + '>';
if (isMenu) {
html += '<i class="'+ (itemType.indexOf('left') !== -1 ? 'left' : '') + ' dropdown icon"></i>';
}
if(option[fields.image]) {
html += '<img class="'+(option[fields.imageClass] ? deQuote(option[fields.imageClass]) : className.image)+'" src="' + deQuote(option[fields.image]) + '">';
html += '<img class="'+deQuote(option[fields.imageClass] ? option[fields.imageClass] : className.image)+'" src="' + deQuote(option[fields.image]) + '">';
}
if(option[fields.icon]) {
html += '<i class="'+deQuote(option[fields.icon])+' '+(option[fields.iconClass] ? deQuote(option[fields.iconClass]) : className.icon)+'"></i>';
html += '<i class="'+deQuote(option[fields.icon]+' '+(option[fields.iconClass] ? option[fields.iconClass] : className.icon))+'"></i>';
}
if(hasDescription){
html += '<span class="'+ className.description +'">'+ escape(option[fields.description] || '', preserveHTML) + '</span>';
html += (!isMenu) ? '<span class="'+ className.text + '">' : '';
html += '<span class="'+ deQuote(className.description) +'">'+ escape(option[fields.description] || '', preserveHTML) + '</span>';
html += (!isMenu) ? '<span class="'+ deQuote(className.text) + '">' : '';
}
if (isMenu) {
html += '<span class="' + className.text + '">';
html += '<span class="' + deQuote(className.text) + '">';
}
html += escape(option[fields.name] || '', preserveHTML);
if (isMenu) {
html += '</span>';
html += '<div class="' + itemType + '">';
html += '<div class="' + deQuote(itemType) + '">';
html += $.fn.dropdown.settings.templates.menu(option, fields, preserveHTML, className);
html += '</div>';
} else if(hasDescription){
Expand All @@ -4333,18 +4334,18 @@ $.fn.dropdown.settings.templates = {
html += '</div>';
} else if (itemType === 'header') {
var groupName = escape(option[fields.name] || '', preserveHTML),
groupIcon = option[fields.icon] ? deQuote(option[fields.icon]) : className.groupIcon
groupIcon = deQuote(option[fields.icon] ? option[fields.icon] : className.groupIcon)
;
if(groupName !== '' || groupIcon !== '') {
html += '<div class="' + (option[fields.class] ? deQuote(option[fields.class]) : className.header) + '">';
html += '<div class="' + deQuote(option[fields.class] ? option[fields.class] : className.header) + '">';
if (groupIcon !== '') {
html += '<i class="' + groupIcon + ' ' + (option[fields.iconClass] ? deQuote(option[fields.iconClass]) : className.icon) + '"></i>';
html += '<i class="' + deQuote(groupIcon + ' ' + (option[fields.iconClass] ? option[fields.iconClass] : className.icon)) + '"></i>';
}
html += groupName;
html += '</div>';
}
if(option[fields.divider]){
html += '<div class="'+className.divider+'"></div>';
html += '<div class="'+deQuote(className.divider)+'"></div>';
}
}
});
Expand All @@ -4354,8 +4355,10 @@ $.fn.dropdown.settings.templates = {
// generates label for multiselect
label: function(value, text, preserveHTML, className) {
var
escape = $.fn.dropdown.settings.templates.escape;
return escape(text,preserveHTML) + '<i class="'+className.delete+' icon"></i>';
escape = $.fn.dropdown.settings.templates.escape,
deQuote = $.fn.dropdown.settings.templates.deQuote
;
return escape(text,preserveHTML) + '<i class="'+deQuote(className.delete)+' icon"></i>';
},


Expand Down
16 changes: 11 additions & 5 deletions src/definitions/modules/embed.js
View file
Original file line number Diff line number Diff line change
Expand Up @@ -671,26 +671,32 @@ $.fn.embed.settings = {
},

templates: {
deQuote: function(string, encode) {
return String(string).replace(/"/g,encode ? "&quot;" : "");
},
iframe : function(url, parameters) {
var src = url;
var src = url,
deQuote = $.fn.embed.settings.templates.deQuote
;
if (parameters) {
src += '?' + parameters;
}
return ''
+ '<iframe src="' + src + '"'
+ '<iframe src="' + deQuote(src) + '"'
+ ' width="100%" height="100%"'
+ ' webkitAllowFullScreen mozallowfullscreen allowFullScreen></iframe>'
;
},
placeholder : function(image, icon) {
var
html = ''
html = '',
deQuote = $.fn.embed.settings.templates.deQuote
;
if(icon) {
html += '<i class="' + icon + ' icon"></i>';
html += '<i class="' + deQuote(icon) + ' icon"></i>';
}
if(image) {
html += '<img class="placeholder" src="' + image + '">';
html += '<img class="placeholder" src="' + deQuote(image) + '">';
}
return html;
}
Expand Down
2 changes: 1 addition & 1 deletion src/definitions/modules/modal.js
View file
Original file line number Diff line number Diff line change
Expand Up @@ -1507,7 +1507,7 @@ $.fn.modal.settings.templates = {
denyFn = function(){args.handler(null)}
;
if (input.length === 0) {
args.content += '<p><div class="'+settings.className.prompt+'"><input placeholder="'+this.helpers.deQuote(args.placeholder || '')+'" type="text" value="'+this.helpers.deQuote(args.defaultValue || '')+'"></div></p>';
args.content += '<p><div class="'+this.helpers.deQuote(settings.className.prompt)+'"><input placeholder="'+this.helpers.deQuote(args.placeholder || '')+'" type="text" value="'+this.helpers.deQuote(args.defaultValue || '')+'"></div></p>';
}
return {
title : args.title,
Expand Down
8 changes: 6 additions & 2 deletions src/definitions/modules/rating.js
View file
Original file line number Diff line number Diff line change
Expand Up @@ -536,13 +536,17 @@ $.fn.rating.settings = {
},

templates: {
deQuote: function(string, encode) {
return String(string).replace(/"/g,encode ? "&quot;" : "");
},
icon: function(maxRating, iconClass) {
var
icon = 1,
html = ''
html = '',
deQuote = $.fn.rating.settings.templates.deQuote
;
while(icon <= maxRating) {
html += '<i class="'+iconClass+' icon"></i>';
html += '<i class="'+deQuote(iconClass)+' icon"></i>';
icon++;
}
return html;
Expand Down

0 comments on commit 1513222

Please sign in to comment.