CodingPirates/blockly
1
0
Fork 0
mirror of https://github.com/google/blockly.git synced 2025-12-16 06:10:12 +01:00
Code Issues Packages Projects Releases Wiki Activity

Fix colour injection vulnerability.

Browse Source 
The new validators already solve this problem, but as a second layer of defence, the generators should also be secured.  Issue #2637
This commit is contained in:
Neil Fraser
2019-07-15 15:45:38 -07:00
committed by Neil Fraser
parent ff9da74571
commit 92c4d6d3a3
5 changed files with 5 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
generators/dart/colour.js
View File

@@ -33,7 +33,7 @@ Blockly.Dart.addReservedWords('Math');
Blockly.Dart['colour_picker'] = function(block) {
// Colour picker.
var code = '\'' + block.getFieldValue('COLOUR') + '\'';
var code = Blockly.Dart.quote_(block.getFieldValue('COLOUR'));
return [code, Blockly.Dart.ORDER_ATOMIC];
};

2
generators/javascript/colour.js
View File

@@ -31,7 +31,7 @@ goog.require('Blockly.JavaScript');
Blockly.JavaScript['colour_picker'] = function(block) {
// Colour picker.
var code = '\'' + block.getFieldValue('COLOUR') + '\'';
var code = Blockly.JavaScript.quote_(block.getFieldValue('COLOUR'));
return [code, Blockly.JavaScript.ORDER_ATOMIC];
};

2
generators/lua/colour.js
View File

@@ -31,7 +31,7 @@ goog.require('Blockly.Lua');
Blockly.Lua['colour_picker'] = function(block) {
// Colour picker.
var code = '\'' + block.getFieldValue('COLOUR') + '\'';
var code = Blockly.Lua.quote_(block.getFieldValue('COLOUR'));
return [code, Blockly.Lua.ORDER_ATOMIC];
};

2
generators/php/colour.js
View File

@@ -31,7 +31,7 @@ goog.require('Blockly.PHP');
Blockly.PHP['colour_picker'] = function(block) {
// Colour picker.
var code = '\'' + block.getFieldValue('COLOUR') + '\'';
var code = Blockly.PHP.quote_(block.getFieldValue('COLOUR'));
return [code, Blockly.PHP.ORDER_ATOMIC];
};

2
generators/python/colour.js
View File

@@ -31,7 +31,7 @@ goog.require('Blockly.Python');
Blockly.Python['colour_picker'] = function(block) {
// Colour picker.
var code = '\'' + block.getFieldValue('COLOUR') + '\'';
var code = Blockly.Python.quote_(block.getFieldValue('COLOUR'));
return [code, Blockly.Python.ORDER_ATOMIC];
};