From 3926d4468cc116fd203bf4e299d1676303cdbc1c Mon Sep 17 00:00:00 2001 From: Matt Pass Date: Tue, 22 Apr 2014 08:55:09 +0100 Subject: [PATCH] xssClean function added & used by serverMessage Replaces 5 x based HTML chars --- lib/ice-coder.js | 12 +++++++++++- lib/ice-coder.min.js | 39 ++++++++++++++++++++------------------- 2 files changed, 31 insertions(+), 20 deletions(-) diff --git a/lib/ice-coder.js b/lib/ice-coder.js index 751dc43..b3598d6 100644 --- a/lib/ice-coder.js +++ b/lib/ice-coder.js @@ -1425,7 +1425,7 @@ var ICEcoder = { serverMessage = top.get('serverMessage'); if (message) { - serverMessage.innerHTML = message; + serverMessage.innerHTML = xssClean(message); serverMessage.style.left = "0"; } else { setTimeout(function() {serverMessage.style.left = "2000px";},200); @@ -1987,6 +1987,16 @@ var ICEcoder = { } }, + // Return safe HTML equivalents + xssClean: function(data) { + return data + .replace(/&/g, "&") + .replace(//g, ">") + .replace(/"/g, """) + .replace(/'/g, "'"); + }, + // ============== // TABS // ============== diff --git a/lib/ice-coder.min.js b/lib/ice-coder.min.js index 5361fad..1d1dcc4 100644 --- a/lib/ice-coder.min.js +++ b/lib/ice-coder.min.js @@ -59,7 +59,7 @@ c=a.getCursor().ch;for(var e=d=0;e=a||10<=a)&&top.ICEcoder.mouseX>parseInt(top.ICEcoder.files.style.width,10)&&(top.ICEcoder.tabDragMouseX=top.ICEcoder.mouseX- parseInt(top.ICEcoder.files.style.width,10)-top.ICEcoder.tabDragMouseXStart,top.ICEcoder.tabDragMove());if(top.ICEcoder.ready&&(top.ICEcoder.mouseDown||(top.ICEcoder.draggingFilesW=!1),a=!ICEcoder.draggingTab&&(top.ICEcoder.mouseX>top.ICEcoder.filesW-7&&top.ICEcoder.mouseXd.index+d[0].length;);(b=top.get("content").contentWindow.document.getElementById("cssColor"))&& +a;if(b=top.ICEcoder.filesFrame.contentWindow.document.body)b.style.cursor=a}},serverMessage:function(a){var b;b=top.get("serverMessage");a?(b.innerHTML=xssClean(a),b.style.left="0"):setTimeout(function(){b.style.left="2000px"},200);b.style.opacity=a?1:0},cssColorPreview:function(){var a,b,c,d;if(a=ICEcoder.getcMInstance()){b=a.getLine(a.getCursor().line);for(c=/(#[\da-f]{3}(?:[\da-f]{3})?\b|\b(?:rgb|hsl)a?\([\s\d%,.-]+\)|\b[a-z]+\b)/gi;(d=c.exec(b))&&a.getCursor().ch>d.index+d[0].length;);(b=top.get("content").contentWindow.document.getElementById("cssColor"))&& b.parentNode.removeChild(b);top.ICEcoder.codeAssist&&"CSS"==top.ICEcoder.caretLocType&&(b=top.document.createElement("div"),b.id="cssColor",b.style.position="absolute",b.style.display="block",b.style.width=b.style.height="20px",b.style.zIndex="1000",b.style.background=d?d[0]:"",b.style.cursor="pointer",b.onclick=function(){top.ICEcoder.showColorPicker(d[0])},""==b.style.backgroundColor&&(b.style.display="none"),top.get("header").appendChild(b),a.addWidget(a.getCursor(),top.get("cssColor"),!0))}}, showColorPicker:function(a){top.get("blackMask").style.visibility="visible";top.get("mediaContainer").innerHTML='



'; farbtastic("picker","color");a&&top.get("picker").farbtastic.setColor(a)},drawCanvasImage:function(a){var b,c,d,e,f,g,m,h,k,n,p;b=top.get("canvasPicker").getContext("2d");c=new Image;c.src=a.src;c.onload=function(){top.get("canvasPicker").width=a.width;top.get("canvasPicker").height=a.height;b.drawImage(c,0,0,a.width,a.height)};top.get("canvasPicker").onmousemove=function(a){d=a.pageX-this.offsetLeft;e=a.pageY-this.offsetTop;f=b.getImageData(d,e,1,1).data;g=f[0];m=f[1];h=f[2];k=g+","+m+","+h;n=top.ICEcoder.rgbToHex(g, @@ -86,24 +86,25 @@ mmd(a.getValue())})}},logout:function(){window.location=window.location+"?logout "off"==top.ICEcoder.bugReportStatus&&top.ICEcoder.message("You can start bug reporting in Help > Settings");"error"==top.ICEcoder.bugReportStatus&&top.ICEcoder.message("Error: can't find/access the error file paths");"ok"==top.ICEcoder.bugReportStatus&&top.ICEcoder.message("No new errors found");"bugs"==top.ICEcoder.bugReportStatus&&(a=top.ICEcoder.openFiles.indexOf(top.ICEcoder.bugReportPath.replace(/\|/g,"/")),-1 '+ -a.slice(a.lastIndexOf("/")).replace(/\//,"");top.get("tab"+top.ICEcoder.openFiles.length).title="/"+top.ICEcoder.openFiles[top.ICEcoder.openFiles.length-1].replace(/\//,"");top.ICEcoder.setTabWidths();top.ICEcoder.redoTabHighlight(top.ICEcoder.openFiles.length);top.ICEcoder.selectedTab=top.ICEcoder.openFiles.length;top.ICEcoder.savedPoints.push(0);top.ICEcoder.setPreviousFiles()},nextTab:function(){top.ICEcoder.switchTab(top.ICEcoder.selectedTab+1<=top.ICEcoder.openFiles.length?top.ICEcoder.selectedTab+ -1:1,"noFocus")},previousTab:function(){top.ICEcoder.switchTab(1<=top.ICEcoder.selectedTab-1?top.ICEcoder.selectedTab-1:top.ICEcoder.openFiles.length,"noFocus")},renameTab:function(a,b){var c;top.ICEcoder.openFiles[a-1]=b;c=top.ICEcoder.openFiles[a-1];top.get("tab"+a).innerHTML=' '+ -c.slice(c.lastIndexOf("/")).replace(/\//,"");top.get("tab"+a).title="/"+top.ICEcoder.openFiles[a-1].replace(/\//,"")},redoTabHighlight:function(a){for(var b,c,d=1;d<=ICEcoder.savedPoints.length;d++)top.get("tab"+d).childNodes[0]&&(top.get("tab"+d).childNodes[0].childNodes[0].style.backgroundColor=ICEcoder.savedPoints[d-1]!=top.ICEcoder.getcMInstance(d).changeGeneration()?"#b00":"transparent"),b=d==a?top.ICEcoder.tabFGselected:top.ICEcoder.tabFGnormalTab,"undefined"!=typeof top.ICEcoder.openFiles[d- -1]&&"/[NEW]"!=top.ICEcoder.openFiles[d-1]&&(c=top.ICEcoder.filesFrame.contentWindow.document.getElementById(top.ICEcoder.openFiles[d-1].replace(/\//g,"|")))&&(c.style.backgroundColor=d==a?top.ICEcoder.tabBGcurrent:top.ICEcoder.tabBGopen,c.style.color=d==a?top.ICEcoder.tabFGcurrent:top.ICEcoder.tabFGopenFile),top.get("tab"+d).style.color=b,top.get("tab"+d).style.background=d==a?top.ICEcoder.tabBGcurrent:top.ICEcoder.tabBGopen},closeTab:function(a,b,c){var d;a||(a=top.ICEcoder.selectedTab);ICEcoder.getcMInstance(); -d=!0;c||ICEcoder.savedPoints[a-1]==top.ICEcoder.getcMInstance(a).changeGeneration()||(d=top.ICEcoder.ask("You have made changes.\n\nAre you sure you want to close without saving?"));if(d){c=top.ICEcoder.openFiles[a-1];for(d=a;d -b?parseInt(c*g,10)-parseInt(c*(g-1),10):150,e=0==g?53:parseInt(top.get("tab"+g).style.left,10),f=0==g?0:parseInt(top.get("tab"+g).style.width,10)+18,a?d=-18:(top.get("tab"+(g+1)).style.left=e+f+"px",top.get("tab"+(g+1)).style.width=d+"px"),top.ICEcoder.tabLeftPos.push(e+f);top.get("newTab").style.left=e+f+d+18+"px"}},tabDragStart:function(a){top.ICEcoder.draggingTab=a;top.ICEcoder.diffStartX=top.ICEcoder.mouseX;top.ICEcoder.tabDragMouseXStart=(top.ICEcoder.mouseX-(parseInt(top.ICEcoder.files.style.width, -10)+53+18))%150;top.get("tab"+a).style.zIndex=2;for(var b=1;b<=top.ICEcoder.openFiles.length;b++)top.get("tab"+b).className=b!==a?"tab tabSlide":"tab tabDrag"},tabDragMove:function(){var a,b;a=parseInt(top.get("tab"+top.ICEcoder.openFiles.length).style.width,10)+18;top.ICEcoder.thisLeft=a=53<=top.ICEcoder.tabDragMouseX?top.ICEcoder.tabDragMouseX<=parseInt(top.get("newTab").style.left,10)-a?top.ICEcoder.tabDragMouseX:parseInt(top.get("newTab").style.left,10)-a:53;top.get("tab"+top.ICEcoder.draggingTab).style.left= -a+"px";top.ICEcoder.dragTabNo=top.ICEcoder.draggingTab;for(var c=1;c<=top.ICEcoder.openFiles.length;c++)top.get("tab"+c).style.opacity=c==top.ICEcoder.draggingTab?1:0.5,b=top.ICEcoder.tabLeftPos[c]?top.ICEcoder.tabLeftPos[c]-top.ICEcoder.tabLeftPos[c-1]:b,c!=top.ICEcoder.draggingTab&&(c=top.ICEcoder.tabLeftPos[c-1]?top.ICEcoder.tabLeftPos[c- -1]-b:top.ICEcoder.tabLeftPos[c-1])},tabDragEnd:function(){var a,b;top.ICEcoder.setTabWidths();for(var c=1;c<=top.ICEcoder.openFiles.length;c++)top.ICEcoder.thisLeft>=top.ICEcoder.tabLeftPos[c-1]&&(a=top.ICEcoder.thisLeft==top.ICEcoder.tabLeftPos[0]?1:top.ICEcoder.dragTabNo>c?c+1:c),top.get("tab"+c).className="tab",top.get("tab"+c).style.opacity=1,c!=top.ICEcoder.dragTabNo?top.get("tab"+c).style.zIndex=1:setTimeout(function(){top.get("tab"+c).style.zIndex=1},150);if(top.ICEcoder.thisLeft&&!1!==top.ICEcoder.thisLeft){b= -[];for(c=1;c<=top.ICEcoder.openFiles.length;c++)b.push(c);b.splice(top.ICEcoder.dragTabNo-1,1);b.splice(a-1,0,top.ICEcoder.dragTabNo);ICEcoder.sortTabs(b)}top.ICEcoder.setTabWidths();top.ICEcoder.draggingTab=!1;top.ICEcoder.thisLeft=!1},sortTabs:function(a){var b,c,d;b=[ICEcoder.savedPoints,ICEcoder.openFiles,ICEcoder.openFileMDTs,ICEcoder.cMInstances];c=[[],[],[],[]];for(var e=0;e/g,">").replace(/"/g, +""").replace(/'/g,"'")},switchTab:function(a,b){var c;ICEcoder.selectedTab=a;if(c=ICEcoder.getcMInstance()){ICEcoder.switchMode();for(var d=0;d '+a.slice(a.lastIndexOf("/")).replace(/\//,"");top.get("tab"+top.ICEcoder.openFiles.length).title="/"+top.ICEcoder.openFiles[top.ICEcoder.openFiles.length- +1].replace(/\//,"");top.ICEcoder.setTabWidths();top.ICEcoder.redoTabHighlight(top.ICEcoder.openFiles.length);top.ICEcoder.selectedTab=top.ICEcoder.openFiles.length;top.ICEcoder.savedPoints.push(0);top.ICEcoder.setPreviousFiles()},nextTab:function(){top.ICEcoder.switchTab(top.ICEcoder.selectedTab+1<=top.ICEcoder.openFiles.length?top.ICEcoder.selectedTab+1:1,"noFocus")},previousTab:function(){top.ICEcoder.switchTab(1<=top.ICEcoder.selectedTab-1?top.ICEcoder.selectedTab-1:top.ICEcoder.openFiles.length, +"noFocus")},renameTab:function(a,b){var c;top.ICEcoder.openFiles[a-1]=b;c=top.ICEcoder.openFiles[a-1];top.get("tab"+a).innerHTML=' '+c.slice(c.lastIndexOf("/")).replace(/\//, +"");top.get("tab"+a).title="/"+top.ICEcoder.openFiles[a-1].replace(/\//,"")},redoTabHighlight:function(a){for(var b,c,d=1;d<=ICEcoder.savedPoints.length;d++)top.get("tab"+d).childNodes[0]&&(top.get("tab"+d).childNodes[0].childNodes[0].style.backgroundColor=ICEcoder.savedPoints[d-1]!=top.ICEcoder.getcMInstance(d).changeGeneration()?"#b00":"transparent"),b=d==a?top.ICEcoder.tabFGselected:top.ICEcoder.tabFGnormalTab,"undefined"!=typeof top.ICEcoder.openFiles[d-1]&&"/[NEW]"!=top.ICEcoder.openFiles[d- +1]&&(c=top.ICEcoder.filesFrame.contentWindow.document.getElementById(top.ICEcoder.openFiles[d-1].replace(/\//g,"|")))&&(c.style.backgroundColor=d==a?top.ICEcoder.tabBGcurrent:top.ICEcoder.tabBGopen,c.style.color=d==a?top.ICEcoder.tabFGcurrent:top.ICEcoder.tabFGopenFile),top.get("tab"+d).style.color=b,top.get("tab"+d).style.background=d==a?top.ICEcoder.tabBGcurrent:top.ICEcoder.tabBGopen},closeTab:function(a,b,c){var d;a||(a=top.ICEcoder.selectedTab);ICEcoder.getcMInstance();d=!0;c||ICEcoder.savedPoints[a- +1]==top.ICEcoder.getcMInstance(a).changeGeneration()||(d=top.ICEcoder.ask("You have made changes.\n\nAre you sure you want to close without saving?"));if(d){c=top.ICEcoder.openFiles[a-1];for(d=a;db?parseInt(c*g,10)-parseInt(c*(g- +1),10):150,e=0==g?53:parseInt(top.get("tab"+g).style.left,10),f=0==g?0:parseInt(top.get("tab"+g).style.width,10)+18,a?d=-18:(top.get("tab"+(g+1)).style.left=e+f+"px",top.get("tab"+(g+1)).style.width=d+"px"),top.ICEcoder.tabLeftPos.push(e+f);top.get("newTab").style.left=e+f+d+18+"px"}},tabDragStart:function(a){top.ICEcoder.draggingTab=a;top.ICEcoder.diffStartX=top.ICEcoder.mouseX;top.ICEcoder.tabDragMouseXStart=(top.ICEcoder.mouseX-(parseInt(top.ICEcoder.files.style.width,10)+53+18))%150;top.get("tab"+ +a).style.zIndex=2;for(var b=1;b<=top.ICEcoder.openFiles.length;b++)top.get("tab"+b).className=b!==a?"tab tabSlide":"tab tabDrag"},tabDragMove:function(){var a,b;a=parseInt(top.get("tab"+top.ICEcoder.openFiles.length).style.width,10)+18;top.ICEcoder.thisLeft=a=53<=top.ICEcoder.tabDragMouseX?top.ICEcoder.tabDragMouseX<=parseInt(top.get("newTab").style.left,10)-a?top.ICEcoder.tabDragMouseX:parseInt(top.get("newTab").style.left,10)-a:53;top.get("tab"+top.ICEcoder.draggingTab).style.left=a+"px";top.ICEcoder.dragTabNo= +top.ICEcoder.draggingTab;for(var c=1;c<=top.ICEcoder.openFiles.length;c++)top.get("tab"+c).style.opacity=c==top.ICEcoder.draggingTab?1:0.5,b=top.ICEcoder.tabLeftPos[c]?top.ICEcoder.tabLeftPos[c]-top.ICEcoder.tabLeftPos[c-1]:b,c!=top.ICEcoder.draggingTab&&(c=top.ICEcoder.tabLeftPos[c-1]?top.ICEcoder.tabLeftPos[c-1]-b:top.ICEcoder.tabLeftPos[c- +1])},tabDragEnd:function(){var a,b;top.ICEcoder.setTabWidths();for(var c=1;c<=top.ICEcoder.openFiles.length;c++)top.ICEcoder.thisLeft>=top.ICEcoder.tabLeftPos[c-1]&&(a=top.ICEcoder.thisLeft==top.ICEcoder.tabLeftPos[0]?1:top.ICEcoder.dragTabNo>c?c+1:c),top.get("tab"+c).className="tab",top.get("tab"+c).style.opacity=1,c!=top.ICEcoder.dragTabNo?top.get("tab"+c).style.zIndex=1:setTimeout(function(){top.get("tab"+c).style.zIndex=1},150);if(top.ICEcoder.thisLeft&&!1!==top.ICEcoder.thisLeft){b=[];for(c= +1;c<=top.ICEcoder.openFiles.length;c++)b.push(c);b.splice(top.ICEcoder.dragTabNo-1,1);b.splice(a-1,0,top.ICEcoder.dragTabNo);ICEcoder.sortTabs(b)}top.ICEcoder.setTabWidths();top.ICEcoder.draggingTab=!1;top.ICEcoder.thisLeft=!1},sortTabs:function(a){var b,c,d;b=[ICEcoder.savedPoints,ICEcoder.openFiles,ICEcoder.openFileMDTs,ICEcoder.cMInstances];c=[[],[],[],[]];for(var e=0;e