Added stricter URL filtering to prevent DOM Based XSS when the tree view is enabled (8ba739ad) · Commits · Elphel / doxverilog

src/navtree.js

+28 −18

Original line number	Original line	Diff line number	Diff line
	var SYNCONMSG = 'click to disable panel synchronisation';
	var SYNCOFFMSG = 'click to enable panel synchronisation';
	var navTreeSubIndices = new Array();		var navTreeSubIndices = new Array();

	function getData(varName)		function getData(varName)
	@@ -22,6 +20,21 @@ function stripPath2(uri)
	return m ? uri.substring(i-6) : s;		return m ? uri.substring(i-6) : s;
	}		}

			function hashValue()
			{
			return $(location).attr('hash').substring(1).replace(/[^\w\-]/g,'');
			}

			function hashUrl()
			{
			return '#'+hashValue();
			}

			function pathName()
			{
			return $(location).attr('pathname').replace(/[^-A-Za-z0-9+&@#/%?=~_\|!:,.;]/g, '');
			}

	function localStorageSupported()		function localStorageSupported()
	{		{
	try {		try {
	@@ -180,7 +193,7 @@ function newNode(o, po, text, link, childrenData, lastNode)
	a.className = stripPath(link.replace('#',':'));		a.className = stripPath(link.replace('#',':'));
	if (link.indexOf('#')!=-1) {		if (link.indexOf('#')!=-1) {
	var aname = '#'+link.split('#')[1];		var aname = '#'+link.split('#')[1];
	var srcPage = stripPath($(location).attr('pathname'));		var srcPage = stripPath(pathName());
	var targetPage = stripPath(link.split('#')[0]);		var targetPage = stripPath(link.split('#')[0]);
	a.href = srcPage!=targetPage ? url : "javascript:void(0)";		a.href = srcPage!=targetPage ? url : "javascript:void(0)";
	a.onclick = function(){		a.onclick = function(){
	@@ -274,11 +287,10 @@ function glowEffect(n,duration)

	function highlightAnchor()		function highlightAnchor()
	{		{
	var aname = $(location).attr('hash');		var aname = hashUrl();
	var anchor = $(aname);		var anchor = $(aname);
	if (anchor.parent().attr('class')=='memItemLeft'){		if (anchor.parent().attr('class')=='memItemLeft'){
	var rows = $('.memberdecls tr[class$="'+		var rows = $('.memberdecls tr[class$="'+hashValue()+'"]');
	window.location.hash.substring(1).replace(/</g,'\\3c ')+'"]');
	glowEffect(rows.children(),300); // member without details		glowEffect(rows.children(),300); // member without details
	} else if (anchor.parent().attr('class')=='fieldname'){		} else if (anchor.parent().attr('class')=='fieldname'){
	glowEffect(anchor.parent().parent(),1000); // enum value		glowEffect(anchor.parent().parent(),1000); // enum value
	@@ -296,8 +308,8 @@ function selectAndHighlight(hash,n)
	{		{
	var a;		var a;
	if (hash) {		if (hash) {
	var link=stripPath($(location).attr('pathname'))+':'+hash.substring(1);		var link=stripPath(pathName())+':'+hash.substring(1);
	a=$('.item a[class$="'+link.replace(/</g,'\\3c ')+'"]');		a=$('.item a[class$="'+link+'"]');
	}		}
	if (a && a.length) {		if (a && a.length) {
	a.parent().parent().addClass('selected');		a.parent().parent().addClass('selected');
	@@ -407,14 +419,13 @@ function navTo(o,root,hash,relpath)
	if (link) {		if (link) {
	var parts = link.split('#');		var parts = link.split('#');
	root = parts[0];		root = parts[0];
	if (parts.length>1) hash = '#'+parts[1];		if (parts.length>1) hash = '#'+parts[1].replace(/[^\w\-]/g,'');
	else hash='';		else hash='';
	}		}
	if (hash.match(/^#l\d+$/)) {		if (hash.match(/^#l\d+$/)) {
	var anchor=$('a[name='+hash.substring(1)+']');		var anchor=$('a[name='+hash.substring(1)+']');
	glowEffect(anchor.parent(),1000); // line number		glowEffect(anchor.parent(),1000); // line number
	hash=''; // strip line number anchors		hash=''; // strip line number anchors
	//root=root.replace(/_source\./,'.'); // source link to doc link
	}		}
	var url=root+hash;		var url=root+hash;
	var i=-1;		var i=-1;
	@@ -448,7 +459,7 @@ function toggleSyncButton(relpath)
	if (navSync.hasClass('sync')) {		if (navSync.hasClass('sync')) {
	navSync.removeClass('sync');		navSync.removeClass('sync');
	showSyncOff(navSync,relpath);		showSyncOff(navSync,relpath);
	storeLink(stripPath2($(location).attr('pathname'))+$(location).attr('hash'));		storeLink(stripPath2(pathName())+hashUrl());
	} else {		} else {
	navSync.addClass('sync');		navSync.addClass('sync');
	showSyncOn(navSync,relpath);		showSyncOn(navSync,relpath);
	@@ -488,7 +499,7 @@ function initNavTree(toroot,relpath)
	}		}

	$(window).load(function(){		$(window).load(function(){
	navTo(o,toroot,window.location.hash,relpath);		navTo(o,toroot,hashUrl(),relpath);
	showRoot();		showRoot();
	});		});

	@@ -496,21 +507,20 @@ function initNavTree(toroot,relpath)
	if (window.location.hash && window.location.hash.length>1){		if (window.location.hash && window.location.hash.length>1){
	var a;		var a;
	if ($(location).attr('hash')){		if ($(location).attr('hash')){
	var clslink=stripPath($(location).attr('pathname'))+':'+		var clslink=stripPath(pathName())+':'+hashValue();
	$(location).attr('hash').substring(1);
	a=$('.item a[class$="'+clslink.replace(/</g,'\\3c ')+'"]');		a=$('.item a[class$="'+clslink.replace(/</g,'\\3c ')+'"]');
	}		}
	if (a==null \|\| !$(a).parent().parent().hasClass('selected')){		if (a==null \|\| !$(a).parent().parent().hasClass('selected')){
	$('.item').removeClass('selected');		$('.item').removeClass('selected');
	$('.item').removeAttr('id');		$('.item').removeAttr('id');
	}		}
	var link=stripPath2($(location).attr('pathname'));		var link=stripPath2(pathName());
	navTo(o,link,$(location).attr('hash'),relpath);		navTo(o,link,hashUrl(),relpath);
	} else if (!animationInProgress) {		} else if (!animationInProgress) {
	$('#doc-content').scrollTop(0);		$('#doc-content').scrollTop(0);
	$('.item').removeClass('selected');		$('.item').removeClass('selected');
	$('.item').removeAttr('id');		$('.item').removeAttr('id');
	navTo(o,toroot,window.location.hash,relpath);		navTo(o,toroot,hashUrl(),relpath);
	}		}
	})		})
	}		}