Skip to content

Commit 325e67d

Browse files
derrickawash6898
derrickaw
authored and
ash6898
committed
address DOM text reinterpreted as HTML alert (apache#38949)
* address DOM text reinterpreted as HTML alert * address gemini comments * fix a few more gemini comments * address more gemini * address gemini
1 parent 3991c3a commit 325e67d

7 files changed

Lines changed: 80 additions & 12 deletions

File tree

‎website/www/site/assets/js/bootstrap.js‎

Lines changed: 40 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -109,7 +109,12 @@ if (typeof jQuery === 'undefined') {
109109
selector = selector && selector.replace(/.*(?=#[^\s]*$)/, '') // strip for ie7
110110
}
111111

112-
var $parent = $(selector)
112+
var $parent
113+
try {
114+
$parent = selector ? $(document).find(selector) : $()
115+
} catch (e) {
116+
$parent = $()
117+
}
113118

114119
if (e) e.preventDefault()
115120

@@ -502,7 +507,14 @@ if (typeof jQuery === 'undefined') {
502507
var clickHandler = function (e) {
503508
var href
504509
var $this = $(this)
505-
var $target = $($this.attr('data-target') || (href = $this.attr('href')) && href.replace(/.*(?=#[^\s]+$)/, '')) // strip for ie7
510+
var selector = $this.attr('data-target') || (href = $this.attr('href')) && href.replace(/.*(?=#[^\s]+$)/, '') // strip for ie7
511+
var $target
512+
try {
513+
$target = selector ? $(document).find(selector) : $()
514+
} catch (e) {
515+
$target = $()
516+
}
517+
506518
if (!$target.hasClass('carousel')) return
507519
var options = $.extend({}, $target.data(), $this.data())
508520
var slideIndex = $this.attr('data-slide-to')
@@ -691,7 +703,11 @@ if (typeof jQuery === 'undefined') {
691703
var target = $trigger.attr('data-target')
692704
|| (href = $trigger.attr('href')) && href.replace(/.*(?=#[^\s]+$)/, '') // strip for ie7
693705

694-
return $(target)
706+
try {
707+
return target ? $(document).find(target) : $()
708+
} catch (e) {
709+
return $()
710+
}
695711
}
696712

697713

@@ -773,7 +789,12 @@ if (typeof jQuery === 'undefined') {
773789
selector = selector && /#[A-Za-z]/.test(selector) && selector.replace(/.*(?=#[^\s]*$)/, '') // strip for ie7
774790
}
775791

776-
var $parent = selector && $(selector)
792+
var $parent
793+
try {
794+
$parent = selector && $(document).find(selector)
795+
} catch (e) {
796+
$parent = $()
797+
}
777798

778799
return $parent && $parent.length ? $parent : $this.parent()
779800
}
@@ -1230,7 +1251,13 @@ if (typeof jQuery === 'undefined') {
12301251
$(document).on('click.bs.modal.data-api', '[data-toggle="modal"]', function (e) {
12311252
var $this = $(this)
12321253
var href = $this.attr('href')
1233-
var $target = $($this.attr('data-target') || (href && href.replace(/.*(?=#[^\s]+$)/, ''))) // strip for ie7
1254+
var selector = $this.attr('data-target') || (href && href.replace(/.*(?=#[^\s]+$)/, '')) // strip for ie7
1255+
var $target
1256+
try {
1257+
$target = selector ? $(document).find(selector) : $()
1258+
} catch (e) {
1259+
$target = $()
1260+
}
12341261
var option = $target.data('bs.modal') ? 'toggle' : $.extend({ remote: !/#/.test(href) && href }, $target.data(), $this.data())
12351262

12361263
if ($this.is('a')) e.preventDefault()
@@ -1550,11 +1577,18 @@ if (typeof jQuery === 'undefined') {
15501577
.css(isVertical ? 'top' : 'left', '')
15511578
}
15521579

1580+
function sanitizeHtml(string) {
1581+
if (typeof DOMPurify !== 'undefined' && typeof string === 'string') {
1582+
return DOMPurify.sanitize(string)
1583+
}
1584+
return string
1585+
}
1586+
15531587
Tooltip.prototype.setContent = function () {
15541588
var $tip = this.tip()
15551589
var title = this.getTitle()
15561590

1557-
$tip.find('.tooltip-inner')[this.options.html ? 'html' : 'text'](title)
1591+
$tip.find('.tooltip-inner')[this.options.html ? 'html' : 'text'](this.options.html ? sanitizeHtml(title) : title)
15581592
$tip.removeClass('fade in top bottom left right')
15591593
}
15601594

‎website/www/site/assets/js/bootstrap/alert.js‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -31,7 +31,12 @@
3131
selector = selector && selector.replace(/.*(?=#[^\s]*$)/, '') // strip for ie7
3232
}
3333

34-
var $parent = $(selector)
34+
var $parent
35+
try {
36+
$parent = selector ? $(document).find(selector) : $()
37+
} catch (e) {
38+
$parent = $()
39+
}
3540

3641
if (e) e.preventDefault()
3742

‎website/www/site/assets/js/bootstrap/carousel.js‎

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -208,7 +208,14 @@
208208
var clickHandler = function (e) {
209209
var href
210210
var $this = $(this)
211-
var $target = $($this.attr('data-target') || (href = $this.attr('href')) && href.replace(/.*(?=#[^\s]+$)/, '')) // strip for ie7
211+
var selector = $this.attr('data-target') || (href = $this.attr('href')) && href.replace(/.*(?=#[^\s]+$)/, '') // strip for ie7
212+
var $target
213+
try {
214+
$target = selector ? $(document).find(selector) : $()
215+
} catch (e) {
216+
$target = $()
217+
}
218+
212219
if (!$target.hasClass('carousel')) return
213220
var options = $.extend({}, $target.data(), $this.data())
214221
var slideIndex = $this.attr('data-slide-to')

‎website/www/site/assets/js/bootstrap/collapse.js‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -159,7 +159,11 @@
159159
var target = $trigger.attr('data-target')
160160
|| (href = $trigger.attr('href')) && href.replace(/.*(?=#[^\s]+$)/, '') // strip for ie7
161161

162-
return $(target)
162+
try {
163+
return target ? $(document).find(target) : $()
164+
} catch (e) {
165+
return $()
166+
}
163167
}
164168

165169

‎website/www/site/assets/js/bootstrap/dropdown.js‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -29,7 +29,12 @@
2929
selector = selector && /#[A-Za-z]/.test(selector) && selector.replace(/.*(?=#[^\s]*$)/, '') // strip for ie7
3030
}
3131

32-
var $parent = selector && $(selector)
32+
var $parent
33+
try {
34+
$parent = selector && $(document).find(selector)
35+
} catch (e) {
36+
$parent = $()
37+
}
3338

3439
return $parent && $parent.length ? $parent : $this.parent()
3540
}

‎website/www/site/assets/js/bootstrap/modal.js‎

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -320,7 +320,13 @@
320320
$(document).on('click.bs.modal.data-api', '[data-toggle="modal"]', function (e) {
321321
var $this = $(this)
322322
var href = $this.attr('href')
323-
var $target = $($this.attr('data-target') || (href && href.replace(/.*(?=#[^\s]+$)/, ''))) // strip for ie7
323+
var selector = $this.attr('data-target') || (href && href.replace(/.*(?=#[^\s]+$)/, '')) // strip for ie7
324+
var $target
325+
try {
326+
$target = selector ? $(document).find(selector) : $()
327+
} catch (e) {
328+
$target = $()
329+
}
324330
var option = $target.data('bs.modal') ? 'toggle' : $.extend({ remote: !/#/.test(href) && href }, $target.data(), $this.data())
325331

326332
if ($this.is('a')) e.preventDefault()

‎website/www/site/assets/js/bootstrap/tooltip.js‎

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -302,11 +302,18 @@
302302
.css(isVertical ? 'top' : 'left', '')
303303
}
304304

305+
function sanitizeHtml(string) {
306+
if (typeof DOMPurify !== 'undefined' && typeof string === 'string') {
307+
return DOMPurify.sanitize(string)
308+
}
309+
return string
310+
}
311+
305312
Tooltip.prototype.setContent = function () {
306313
var $tip = this.tip()
307314
var title = this.getTitle()
308315

309-
$tip.find('.tooltip-inner')[this.options.html ? 'html' : 'text'](title)
316+
$tip.find('.tooltip-inner')[this.options.html ? 'html' : 'text'](this.options.html ? sanitizeHtml(title) : title)
310317
$tip.removeClass('fade in top bottom left right')
311318
}
312319

0 commit comments

Comments
 (0)