prevent script tags inside of error popup
Scott Baker [Sat, 24 Jan 2015 01:42:17 +0000 (17:42 -0800)]
planetstack/core/xoslib/static/js/xoslib/xos-util.js
planetstack/core/xoslib/static/js/xoslib/xosHelper.js

index 04bd041..6f4db85 100644 (file)
@@ -143,6 +143,17 @@ function make_same_width(containerSelector, itemSelector) {
     $(containerSelector).find(itemSelector).each( function(index) { $(this).width(maxWidth); });
 }
 
+function strip_scripts(s) {
+    var div = document.createElement('div');\r
+    div.innerHTML = s;\r
+    var scripts = div.getElementsByTagName('script');\r
+    var i = scripts.length;\r
+    while (i--) {\r
+      scripts[i].parentNode.removeChild(scripts[i]);\r
+    }\r
+    return div.innerHTML;\r
+  }
+
 function parse_portlist(ports) {
     /* Support a list of ports in the format "protocol:port, protocol:port, ..."
         examples:
index 7392843..384a7ed 100644 (file)
@@ -150,7 +150,7 @@ XOSApplication = Marionette.Application.extend({
         if (parsed_error) {
             $("#xos-error-dialog").html(templateFromId("#xos-error-response")(parsed_error));
         } else {
-            $("#xos-error-dialog").html(templateFromId("#xos-error-rawresponse")({responseText: responseText}))
+            $("#xos-error-dialog").html(templateFromId("#xos-error-rawresponse")({responseText: strip_scripts(responseText)}))
         }
 
         $("#xos-error-dialog").dialog({