RetailCRM-Mirror/select2
1
0
Fork 0
mirror of synced 2024-11-30 00:26:03 +03:00
Code Issues Projects Releases Wiki Activity

Merge pull request #691 from jelte12345/master

Browse Source 
Fix XSS injection
This commit is contained in:
Igor Vaynberg 2013-01-11 16:39:48 -08:00
commit 353672832d
1 changed files with 23 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

34
select2.js
View File

@ -263,20 +263,20 @@ the specific language governing permissions and limitations under the Apache Lic
return sizer.width(); return sizer.width();
} }
function markMatch(text, term, markup) { function markMatch(text, term, markup, escapeMarkup) {
var match=text.toUpperCase().indexOf(term.toUpperCase()), var match=text.toUpperCase().indexOf(term.toUpperCase()),
tl=term.length; tl=term.length;
if (match<0) { if (match<0) {
markup.push(text); markup.push(escapeMarkup(text));
return; return;
} }
markup.push(text.substring(0, match)); markup.push(escapeMarkup(text.substring(0, match)));
markup.push("<span class='select2-match'>"); markup.push("<span class='select2-match'>");
markup.push(text.substring(match, match + tl)); markup.push(escapeMarkup(text.substring(match, match + tl)));
markup.push("</span>"); markup.push("</span>");
markup.push(text.substring(match + tl, text.length)); markup.push(escapeMarkup(text.substring(match + tl, text.length)));
} }
/** /**
@ -730,7 +730,7 @@ the specific language governing permissions and limitations under the Apache Lic
formatted=opts.formatResult(result, label, query); formatted=opts.formatResult(result, label, query);
if (formatted!==undefined) { if (formatted!==undefined) {
label.html(self.opts.escapeMarkup(formatted)); label.html(formatted);
} }
node.append(label); node.append(label);
@ -1231,7 +1231,7 @@ the specific language governing permissions and limitations under the Apache Lic
} }
function render(html) { function render(html) {
results.html(self.opts.escapeMarkup(html)); results.html(html);
postRender(); postRender();
} }
@ -2420,7 +2420,7 @@ the specific language governing permissions and limitations under the Apache Lic
dropdownCssClass: "", dropdownCssClass: "",
formatResult: function(result, container, query) { formatResult: function(result, container, query) {
var markup=[]; var markup=[];
markMatch(result.text, query.term, markup); markMatch(result.text, query.term, markup, this.escapeMarkup);
return markup.join(""); return markup.join("");
}, },
formatSelection: function (data, container) { formatSelection: function (data, container) {
@ -2448,9 +2448,21 @@ the specific language governing permissions and limitations under the Apache Lic
tokenSeparators: [], tokenSeparators: [],
tokenizer: defaultTokenizer, tokenizer: defaultTokenizer,
escapeMarkup: function (markup) { escapeMarkup: function (markup) {
if (markup && typeof(markup) === "string") { var replace_map = {
return markup.replace(/&/g, "&amp;"); '\\': '&#92;',
} '&': '&#amp;',
'<': '&#lt;',
'>': '&#rt;',
'"': '&#quot;',
"'": '&#39;',
"/": '&#x2F;'
};
//'--': '-&#45;'
return String(html).replace(/[&<>"'/\\]/g, function (match) {
return replace_map[match[0]];
});
return markup; return markup;
}, },
blurOnChange: false, blurOnChange: false,