Fix unescaped HTML / XSS vulnerability in Query results

Author: werrolf

Resources/public/queryBuilder.element.js

@@ -189,25 +189,15 @@
             });
         },
 
-        /**
-         * Get column names
-         *
-         * @param items
-         * @returns {Array}
-         */
-        getColumnNames: function(items) {
-            var columns = [];
-            if(items.length) {
-                for (var key in items[0]) {
-                    columns.push({
-                        data:  key,
-                        title: key
-                    });
-                }
-            }
-            return columns;
+        _escapeHtml: function(value) {
+            'use strict';
+            return ('' + (value || '')).replace(/["&'\/<>]/g, function (a) {
+                return {
+                    '"': '&quot;', '&': '&amp;', "'": '&#39;',
+                    '/': '&#47;',  '<': '&lt;',  '>': '&gt;'
+                }[a];
+            });
         },
-
         /**
          * Executes SQL by ID and display results as popups
          *
@@ -225,7 +215,22 @@
                 if (!results || !results.length) {
                     columnsOption = [{data: null, title: ''}];
                 } else {
-                    columnsOption = widget.getColumnNames(results)
+                    var columnNames = Object.keys(results[0]);
+                    columnsOption = columnNames.map(function(name) {
+                        return {
+                            title: name,
+                            render: function(data, type, row) {
+                                switch (type) {
+                                    case 'display':
+                                        return widget._escapeHtml(row[name]);
+                                    case 'filter':
+                                        return ('' + row[name]) || undefined;
+                                    default:
+                                        return row[name];
+                                }
+                            }
+                         };
+                    });
                 }
                 $content.append(widget.initDataTable({
                     selectable: false,