CodingPirates/blockly
1
0
Fork 0
mirror of https://github.com/google/blockly.git synced 2026-01-09 01:50:11 +01:00
Code Issues Packages Projects Releases Wiki Activity

Fix injection vulnerability in Block Factories.

Browse Source 
Fixes issue #756.
This commit is contained in:
Neil Fraser
2019-08-01 16:36:56 -07:00
committed by Neil Fraser
parent e77a9b7e81
commit ae24b544f3
4 changed files with 12 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
demos/blockfactory/factory_utils.js
View File

@@ -902,9 +902,9 @@ FactoryUtils.defineAndGetBlockTypes = function(blockDefsString, format) {
FactoryUtils.injectCode = function(code, id) {
var pre = document.getElementById(id);
pre.textContent = code;
code = pre.textContent;
code = PR.prettyPrintOne(code, 'js');
pre.innerHTML = code;
// Remove the 'prettyprinted' class, so that Prettify will recalculate.
pre.className = pre.className.replace('prettyprinted', '');
PR.prettyPrint();
};
/**

8
demos/blockfactory/index.html
View File

@@ -124,11 +124,11 @@
<h3>Export Preview</h3>
<div id="blockDefs" class="exportPreviewTextArea">
<p id="blockDefs_label">Block Definitions:</p>
<pre id="blockDefs_textArea"></pre>
<pre id="blockDefs_textArea" class="prettyprint lang-js"></pre>
</div>
<div id="genStubs" class="exportPreviewTextArea">
<p id="genStubs_label">Generator Stubs:</p>
<pre id="genStubs_textArea"></pre>
<pre id="genStubs_textArea" class="prettyprint lang-js"></pre>
</div>
</div>
</div>
@@ -378,7 +378,7 @@
</tr>
<tr>
<td height="30%">
<pre id="languagePre"></pre>
<pre id="languagePre" class="prettyprint lang-js"></pre>
<textarea id="languageTA"></textarea>
</td>
</tr>
@@ -397,7 +397,7 @@
</tr>
<tr>
<td height="30%">
<pre id="generatorPre"></pre>
<pre id="generatorPre" class="prettyprint lang-js"></pre>
</td>
</tr>
</table>

6
demos/blockfactory_old/factory.js
View File

@@ -748,9 +748,9 @@ function updatePreview() {
function injectCode(code, id) {
var pre = document.getElementById(id);
pre.textContent = code;
code = pre.textContent;
code = PR.prettyPrintOne(code, 'js');
pre.innerHTML = code;
// Remove the 'prettyprinted' class, so that Prettify will recalculate.
pre.className = pre.className.replace('prettyprinted', '');
PR.prettyPrint();
}
/**

4
demos/blockfactory_old/index.html
View File

@@ -148,7 +148,7 @@
</tr>
<tr>
<td height="30%">
<pre id="languagePre"></pre>
<pre id="languagePre" class="prettyprint lang-js"></pre>
<textarea id="languageTA"></textarea>
</td>
</tr>
@@ -167,7 +167,7 @@
</tr>
<tr>
<td height="30%">
<pre id="generatorPre"></pre>
<pre id="generatorPre" class="prettyprint lang-js"></pre>
</td>
</tr>
</table>