Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[PPP-5370][Update XSS Vulnerabilities] #5758

Open
wants to merge 4 commits into
base: XSS-PPP-5370
Choose a base branch
from
Open

[PPP-5370][Update XSS Vulnerabilities] #5758

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
c14f53f
[PPP-5370][Update XSS Vulnerabilities]
mmujahiduddin Oct 30, 2024
0e882a0
Update End Of Line
mmujahiduddin Oct 30, 2024
b3b5988
Merge branch 'pentaho:PPP-5370' into PPP-5370
mmujahiduddin Nov 11, 2024
9c795c4
Update Review Comments#1
mmujahiduddin Nov 13, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 3 additions & 2 deletions assemblies/pentaho-war/src/main/webapp/js/ajaxslt/dom.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -34,7 +34,8 @@
// Spec. However, different browsers actually pass very different
// values at the API.
//
function xmlResolveEntities(s) {

function xmlResolveEntities(s) {

var parts = stringSplit(s, '&');

Expand Down Expand Up @@ -73,7 +74,7 @@ function xmlResolveEntities(s) {
// through the W3C DOM. W3C DOM access is specified to resolve
// entities.
var span = window.document.createElement('span');
span.innerHTML = '&' + rp[0] + '; ';
pho.util.xss.setHtml(span, '&' + rp[0] + '; ');
ch = span.childNodes[0].nodeValue.charAt(0);
}
ret += ch + rp[1];
Expand Down
6 changes: 2 additions & 4 deletions assemblies/pentaho-war/src/main/webapp/js/google-demo.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -86,7 +86,7 @@ greenicon = icon;

function updateProductMix( content ) {
document.getElementById( 'details-div' ).style.display='block';
document.getElementById( 'details-cell1' ).innerHTML=content;
pho.util.xss.setHtml(document.getElementById('details-cell1'), content);
pentahoAction( "steel-wheels", "google", "customer_details.xaction",
new Array( new Array( "customer", currentRecord[7] ) ),
'updateHistory'
Expand All @@ -95,7 +95,7 @@ greenicon = icon;

function updateHistory( content ) {
document.getElementById( 'details-div' ).style.display='block';
document.getElementById( 'details-cell2' ).innerHTML=content;
pho.util.xss.setHtml(document.getElementById('details-cell2'), content);
}

function showAddress(address, name, custNum, value, selected) {
Expand Down Expand Up @@ -191,6 +191,4 @@ function showAddress(address, name, custNum, value, selected) {
'updateInfoWindow'
);
}


}
4 changes: 2 additions & 2 deletions assemblies/pentaho-war/src/main/webapp/js/options.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,11 +20,11 @@ function runInBackground( url, target )
url = url + "&background=true";
if ( target.toLowerCase().indexOf( 'new' ) >= 0 )
{
var targetWin = window.open( url );
var targetWin = window.open(pho.util.xss.sanitizeUrl(url));
}
else
{
window.location = url;
window.location = pho.util.xss.sanitizeUrl(url);
}
}
return undefined; // forces current page to remain unchanged when target=new
Expand Down
2 changes: 1 addition & 1 deletion assemblies/pentaho-war/src/main/webapp/js/parameters.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -360,7 +360,7 @@ function executeAction (target, submitUrl) {
// convert characters from entities like ı to display characters (HTML)
function convertHtmlEntitiesToCharacters(theStr) {
var newDiv = document.createElement(newDiv);
newDiv.innerHTML = theStr;
pho.util.xss.setHtml(newDiv, theStr);
return newDiv.innerHTML;
}

Expand Down
2 changes: 1 addition & 1 deletion assemblies/pentaho-war/src/main/webapp/js/src/html/util.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -210,7 +210,7 @@ dojo.html.createNodesFromText = function(/* string */txt, /* boolean? */trim){
txt = "<table>" + txt + "</table>";
tableType = "section";
}
tn.innerHTML = txt;
pho.util.xss.setHtml(tn, txt);
if(tn["normalize"]){
tn.normalize();
}
Expand Down
6 changes: 3 additions & 3 deletions assemblies/pentaho-war/src/main/webapp/js/utils.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -294,8 +294,8 @@ function refreshDatePicker(dateFieldName, year, month, day)

// and finally, close the table
html += xTABLE;
document.getElementById(datePickerDivID).innerHTML = html;

pho.util.xss.setHtml(document.getElementById(datePickerDivID), html);
// add an "iFrame shim" to allow the datepicker to display above selection lists
adjustiFrame();
}
Expand Down Expand Up @@ -530,4 +530,4 @@ function isValidName(name){
function reservedCharListForDisplay( separatorString ) {
//ToDo: Fix this
return "/ \ :";
}
}
2 changes: 1 addition & 1 deletion user-console/src/main/resources/org/pentaho/mantle/public/home/content/welcome/js/main.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -50,7 +50,7 @@ CCP.liveChat = function(){
pucOpenTab( name, title, url );
}
else {
window.open( url );
window.open(pho.util.xss.sanitizeUrl(url));
}
}

Expand Down
7 changes: 4 additions & 3 deletions user-console/src/main/resources/org/pentaho/mantle/public/home/js/gettingStarted.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,8 +13,9 @@
define([
"common-ui/util/ContextProvider",
"common-ui/util/BootstrappedTabLoader",
"common-ui/util/HandlebarsCompiler"
], function (ContextProvider, BootstrappedTabLoader, HandlebarsCompiler) {
"common-ui/util/HandlebarsCompiler",
"common-ui/util/xss"
], function (ContextProvider, BootstrappedTabLoader, HandlebarsCompiler, xssUtil) {

var brightCoveVideoTemplate =
'<iframe src="https://players.brightcove.net/4680021553001/default_default/index.html?videoId={{videoId}}&autoplay=true"' +
Expand Down Expand Up @@ -206,7 +207,7 @@ define([

launchLink.unbind("click");
launchLink.bind("click", function () {
window.open(href, "_blank");
window.open(xssUtil.sanitizeUrl(href), "_blank");
});
}

Expand Down