openstack/horizon
Code Issues Proposed changes

Merge "Move the HTML-escaping JavaScript code to a separate function"

Browse Source
This commit is contained in:
Jenkins 2014-07-14 08:28:16 +00:00 committed by Gerrit Code Review
commit e300fe01f1
2 changed files with 17 additions and 13 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
horizon/static/horizon/js/horizon.instances.js
View File

@ -45,25 +45,19 @@ horizon.instances = {
* Initializes an associative array of lists of the current
* networks.
**/
init_network_list: function() {
init_network_list: function () {
horizon.instances.networks_selected = [];
horizon.instances.networks_available = [];
$(this.get_network_element("")).each(function(){
$(this.get_network_element("")).each(function () {
var $this = $(this);
var $input = $this.children("input");
var name = $this.text().replace(/^\s+/,"")
.replace(/&/g, '&')
.replace(/</g, '&lt;')
.replace(/>/g, '&gt;')
.replace(/"/g, '&quot;')
.replace(/'/g, '&#x27;')
.replace(/\//g, '&#x2F;');
var name = horizon.escape_html($this.text().replace(/^\s+/, ""));
var network_property = {
name:name,
id:$input.attr("id"),
value:$input.attr("value")
"name": name,
"id": $input.attr("id"),
"value": $input.attr("value")
};
if($input.is(':checked')) {
if ($input.is(":checked")) {
horizon.instances.networks_selected.push(network_property);
} else {
horizon.instances.networks_available.push(network_property);

10
horizon/static/horizon/js/horizon.js
View File

@ -28,6 +28,16 @@ var Horizon = function () {
initFunctions = [];
};
/* An utility function for escaping HTML to avoid XSS. */
horizon.escape_html = function (text) {
return text.replace(/&/g, '&amp;')
.replace(/</g, '&lt;')
.replace(/>/g, '&gt;')
.replace(/"/g, '&quot;')
.replace(/'/g, '&#x27;')
.replace(/\//g, '&#x2F;');
};
return horizon;
};