5.2.3

package.json

@@ -1,6 +1,6 @@
 {
   "name": "cyberchef",
-  "version": "5.2.0",
+  "version": "5.2.3",
   "description": "CyberChef is a simple, intuitive web app for analysing and decoding data within a web browser.",
   "author": "n1474335 <n1474335@gmail.com>",
   "homepage": "https://gchq.github.io/CyberChef",

src/web/ControlsWaiter.js

@@ -244,7 +244,7 @@ ControlsWaiter.prototype.loadClick = function() {
  * Saves the recipe specified in the save textarea to local storage.
  */
 ControlsWaiter.prototype.saveButtonClick = function() {
-    var recipeName = document.getElementById("save-name").value,
+    var recipeName = Utils.escapeHtml(document.getElementById("save-name").value),
         recipeStr  = document.getElementById("save-text").value;
 
     if (!recipeName) {
@@ -288,7 +288,8 @@ ControlsWaiter.prototype.populateLoadRecipesList = function() {
     for (i = 0; i < savedRecipes.length; i++) {
         var opt = document.createElement("option");
         opt.value = savedRecipes[i].id;
-        opt.innerHTML = savedRecipes[i].name;
+        // Unescape then re-escape in case localStorage has been corrupted
+        opt.innerHTML = Utils.escapeHtml(Utils.unescapeHtml(savedRecipes[i].name));
 
         loadNameEl.appendChild(opt);
     }

src/web/RecipeWaiter.js

@@ -26,7 +26,6 @@ var RecipeWaiter = function(app, manager) {
 RecipeWaiter.prototype.initialiseOperationDragNDrop = function() {
     var recList = document.getElementById("rec-list");
 
-
     // Recipe list
     Sortable.create(recList, {
         group: "recipe",
@@ -45,7 +44,9 @@ RecipeWaiter.prototype.initialiseOperationDragNDrop = function() {
             }
         }.bind(this),
         onSort: function(evt) {
-            document.dispatchEvent(this.manager.statechange);
+            if (evt.from.id === "rec-list") {
+                document.dispatchEvent(this.manager.statechange);
+            }
         }.bind(this)
     });
 
@@ -75,21 +76,25 @@ RecipeWaiter.prototype.initialiseOperationDragNDrop = function() {
 /**
  * Creates a drag-n-droppable seed list of operations.
  *
- * @param {element} listEl - The list the initialise
+ * @param {element} listEl - The list to initialise
  */
 RecipeWaiter.prototype.createSortableSeedList = function(listEl) {
     Sortable.create(listEl, {
         group: {
             name: "recipe",
             pull: "clone",
-            put: false
+            put: false,
         },
         sort: false,
         setData: function(dataTransfer, dragEl) {
             dataTransfer.setData("Text", dragEl.textContent);
         },
         onStart: function(evt) {
+            // Removes popover element and event bindings from the dragged operation but not the
+            // event bindings from the one left in the operations list. Without manually removing
+            // these bindings, we cannot re-initialise the popover on the stub operation.
             $(evt.item).popover("destroy");
+            $(evt.clone).off(".popover").removeData("bs.popover");
             evt.item.setAttribute("data-toggle", "popover-disabled");
         },
         onEnd: this.opSortEnd.bind(this)