Skip to content

codeql: close js/xss-through-dom alerts in delivery views #130-#143 #60

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
natechadwick-intsof merged 1 commit into from
Aug 15, 2026
Merged

codeql: close js/xss-through-dom alerts in delivery views #130-#143 #60

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 9 additions & 3 deletions delivery/common/js/views/PercArchiveListView.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,6 +30,12 @@
$.PercArchiveListView = {
updateArchiveList : updateArchiveList
};
function percSafeUrl(url)
{
var u = String(url);
if (/^\s*(?:javascript|vbscript|data)\s*:/i.test(u)) {return "#";}
return u;
}
function updateArchiveList()
{
$(".perc-archive-list").each(function(){
Expand Down Expand Up @@ -128,7 +134,7 @@
encodedQuery = "&query=" + encodeURIComponent(JSON.stringify(query));
href = baseURL + pageResult + "?filter="+ encodeURIComponent(row.year) + encodedQuery;
anchorYear = $("<a>")
.attr("href",href)
.attr("href",percSafeUrl(href))
.text(linkYearText);

}
Expand Down Expand Up @@ -188,7 +194,7 @@
encodedQuery = "&query=" + encodeURIComponent(JSON.stringify(query));
href = baseURL + pageResult + "?filter="+ encodeURIComponent(row2.month + " " + row.year )+ encodedQuery;
a = $("<a>")
.attr("href",href )
.attr("href",percSafeUrl(href) )
.text(linkText);
}

Expand Down Expand Up @@ -276,7 +282,7 @@
var encodedQuery = "&query=" + encodeURIComponent(JSON.stringify(query));
var href = baseURL + pageResult + "?filter="+ encodeURIComponent(row2.month +" "+ row.year) + encodedQuery;
a = $("<a>")
.attr("href", href)
.attr("href", percSafeUrl(href))
.text(linkText);
}

Expand Down
8 changes: 4 additions & 4 deletions delivery/common/js/views/PercBlogPostView.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -138,19 +138,19 @@

// Tags
$('.perc-blog-post-tag-container').find('a').each(function(){
var tag = ($(this).html().trim()).replace(",", "");
var tag = ($(this).text().trim()).replace(",", "");
var jsonQuery = {'criteria':["perc:tags LIKE '" + tag + "'"]};
var encodedQuery = "&query=" + encodeURIComponent(JSON.stringify(jsonQuery));
$(this).attr("href", blogIndexPage + "?filter="+ tag + encodedQuery);
$(this).attr("href", blogIndexPage + "?filter="+ encodeURIComponent(tag) + encodedQuery);
});

// Categories
$('.perc-blog-post-category-container').find('a').each(function(){
var categoryPath = $(this).attr('data-categories');
var category = ($(this).html().trim()).replace(",", "");
var category = ($(this).text().trim()).replace(",", "");
var jsonQuery = {'criteria':["perc:category LIKE '" + categoryPath + "'"]};
var encodedQuery = "&query=" + encodeURIComponent(JSON.stringify(jsonQuery));
$(this).attr("href", blogIndexPage + "?filter="+ category + encodedQuery);
$(this).attr("href", blogIndexPage + "?filter="+ encodeURIComponent(category) + encodedQuery);
});
});
}
Expand Down
12 changes: 9 additions & 3 deletions delivery/common/js/views/PercCategoryListView.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -40,6 +40,12 @@
var baseURL;
var strJSON;
var nRow;
function percSafeUrl(url)
{
var u = String(url);
if (/^\s*(?:javascript|vbscript|data)\s*:/i.test(u)) {return "#";}
return u;
}
function updateCategoryList()
{
$(".perc-category-list").each(function(){
Expand Down Expand Up @@ -185,15 +191,15 @@
if(isEditMode === "true" || "undefined" === typeof (pageResult) || "" === pageResult ){
href = "#";
}else{
href = baseURL + pageResult + "?filter=" + node.category + encodedQuery;
href = baseURL + pageResult + "?filter=" + encodeURIComponent(node.category) + encodedQuery;
}

var a = $("<a>")
.attr("href", href)
.attr("href", percSafeUrl(href))
.attr("data-count", countTotal)
.attr("title", nodeStr)
.addClass("perc-node")
.append(nodeStr);
.text(nodeStr);

return $("<li>")
.addClass("perc-category-element")
Expand Down
12 changes: 10 additions & 2 deletions delivery/common/js/views/PercMostReadBlogPostsView.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -61,10 +61,18 @@
});
}

function safeHeadingElem(elemName, defaultName)
{
if ("string" === typeof (elemName) && /^h[1-6]$/i.test(elemName)) {
return elemName.toLowerCase();
}
return defaultName;
}

function createTitleHtml(settings)
{
var title = "";
var elemName = settings.headingStyle || "h2";
var elemName = safeHeadingElem(settings.headingStyle, "h2");
if (settings.listTitle) {
title = $("<div/>")
.append($("<" + elemName + "/>")
Expand All @@ -81,7 +89,7 @@
*/
function createEntryHtml(settings, entry)
{
var headingElem = settings.headingStyle || 'h3';
var headingElem = safeHeadingElem(settings.headingStyle, 'h3');
var pagePath = entry.folder + entry.name;
var promotedPaths = settings.promotedPagePaths || "";
promotedPaths = promotedPaths.split(";");
Expand Down
14 changes: 12 additions & 2 deletions delivery/common/js/views/PercRegistrationView.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,6 +33,16 @@
$.PercRegistrationView = {
init : init
};
/**
* Returns the given url if it uses a safe scheme, otherwise returns the site root.
*/
function percSafeUrl(url) {
var u = String(url);
if (/^\s*(?:javascript|vbscript|data)\s*:/i.test(u)) {
return "/";
}
return u;
}
/**
* Initialize and configure each instance of registration widget in the page.
*/
Expand Down Expand Up @@ -69,7 +79,7 @@
if(!redirectUrl || "" === redirectUrl) {
redirectUrl = "/";
}
window.location.href=redirectUrl;
window.location.href=percSafeUrl(redirectUrl);
}
else {
$(".perc-reg-confirmation-message").text(data.message);
Expand Down Expand Up @@ -257,7 +267,7 @@
if ($.param.querystring()) {
params = '?' + $.param.querystring();
}
window.location = confirmation_page + params;
window.location = percSafeUrl(confirmation_page + params);
}
}
else
Expand Down
57 changes: 39 additions & 18 deletions delivery/common/js/views/PercRssView.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,6 +24,27 @@
$.PercRssView = {
updateRssFeed : updateRssFeed
};

//Escapes a value so it can be safely used as html text or in an attribute value
function escapeHtml(value)
{
var s = ("undefined" === typeof (value) || null === value) ? "" : String(value);
return $('<div>').text(s).html().replace(/"/g, '&quot;');
}

//Only allows simple element names, falls back to the given default
function safeElem(name, defaultName)
{
return ("string" === typeof (name) && /^[a-zA-Z][a-zA-Z0-9]*$/.test(name)) ? name : defaultName;
}

//Blocks script bearing urls
function safeUrl(url)
{
var u = ("undefined" === typeof (url) || null === url) ? "" : String(url);
if (/^\s*(?:javascript|vbscript|data)\s*:/i.test(u)) {return "#";}
return escapeHtml(u);
}

function updateRssFeed()
{
Expand All @@ -39,9 +60,9 @@
{
var feedTitleId = queryString.feedId +"_title";
currentFeedWidget.attr('aria-labelledby', feedTitleId);
var titleElement = queryString.titleElement;
var feedTitle = '<' + titleElement + ' id="' + feedTitleId + '" ';
feedTitle += ' title="' + feed.title + '" class="perc-feed-title"> <a href="' + feed.link + '" target="_blank" rel="noopener noreferrer">' + feed.title + '</a> </'+titleElement+'>';
var titleElement = safeElem(queryString.titleElement, "h2");
var feedTitle = '<' + titleElement + ' id="' + escapeHtml(feedTitleId) + '" ';
feedTitle += ' title="' + escapeHtml(feed.title) + '" class="perc-feed-title"> <a href="' + safeUrl(feed.link) + '" target="_blank" rel="noopener noreferrer">' + escapeHtml(feed.title) + '</a> </'+titleElement+'>';
currentFeedWidget.append(feedTitle);
} else if (null !== feed.title && "undefined" !== typeof (feed.title)) {
currentFeedWidget.attr('aria-label', feed.title);
Expand Down Expand Up @@ -71,11 +92,11 @@
function renderFeedItems(feedItems, queryString, itemLimit) {
var feedItem = '';
var itemAriaRole = queryString.itemAriaRole;
var wrappingElement = queryString.wrappingElement;
var itemElement = queryString.itemElement;
var itemTitleElement = queryString.itemTitleElement;
var itemDateElement = queryString.itemDateElement;
var itemDescriptionElement = queryString.itemDescriptionElement;
var wrappingElement = safeElem(queryString.wrappingElement, 'none');
var itemElement = safeElem(queryString.itemElement, 'div');
var itemTitleElement = safeElem(queryString.itemTitleElement, 'h3');
var itemDateElement = safeElem(queryString.itemDateElement, 'p');
var itemDescriptionElement = safeElem(queryString.itemDescriptionElement, 'p');
var itemIdPrefix = queryString.feedId +"_item_";
var wrappingElemAriaLabel = queryString.wrappingElemAriaLabel;

Expand All @@ -87,7 +108,7 @@
feedItem += ' role="list" ';
}
if (null !== wrappingElemAriaLabel && "undefined" !== typeof (wrappingElemAriaLabel) && ("" !== wrappingElemAriaLabel)) {
feedItem += ' aria-label="' + wrappingElemAriaLabel + '" >';
feedItem += ' aria-label="' + escapeHtml(wrappingElemAriaLabel) + '" >';
}else {
feedItem += ' >';
}
Expand All @@ -101,11 +122,11 @@

if(queryString.showItemTitle && null !== item.title)
{
label='aria-labelledby="' + title_id + '"';
label='aria-labelledby="' + escapeHtml(title_id) + '"';
}
else
{
label='aria-label="' + item.title + '"';
label='aria-label="' + escapeHtml(item.title) + '"';
}

feedItem += '<' +itemElement+' ';
Expand All @@ -114,12 +135,12 @@
feedItem += 'role="listitem" ';
}

feedItem += 'id="'+id+'" class="perc-feed-item"' + label + '>';
feedItem += 'id="'+escapeHtml(id)+'" class="perc-feed-item"' + label + '>';


if(queryString.showItemTitle && item.title)
{
feedItem += '<'+itemTitleElement+' id="'+title_id+'" class="perc-feed-item-title"><a href="' + item.link + '" target="_blank" title="' + item.title + '" rel="noopener noreferrer">' + item.title + '</a> </'+itemTitleElement+'>';
feedItem += '<'+itemTitleElement+' id="'+escapeHtml(title_id)+'" class="perc-feed-item-title"><a href="' + safeUrl(item.link) + '" target="_blank" title="' + escapeHtml(item.title) + '" rel="noopener noreferrer">' + escapeHtml(item.title) + '</a> </'+itemTitleElement+'>';
}

if(queryString.showItemDate && item.updated)
Expand All @@ -132,26 +153,26 @@
formattedDate = formattedDate.replace('hh', date.getHours());
formattedDate = formattedDate.replace('nn', date.getMinutes());

feedItem += '<'+itemDateElement+' class="perc-feed-item-date">' + formattedDate + '</'+itemDateElement+'>';
feedItem += '<'+itemDateElement+' class="perc-feed-item-date">' + escapeHtml(formattedDate) + '</'+itemDateElement+'>';
}

if(queryString.showItemDescription && item.description)
{
var description = $("<"+itemDescriptionElement+">").html(item.description);
var description = $("<"+itemDescriptionElement+">").text(item.description);

if(queryString.itemRemoveHtml)
{
description.html(description.text());
description.text(description.text());
}

if(!queryString.itemDescriptionEmpty)
{
//Truncate description
description.html(description.html().substring(0, queryString.itemDescriptionLength));
description.text(description.text().substring(0, queryString.itemDescriptionLength));
//If there are more description
if('' !== item.description.substring(queryString.itemDescriptionLength + 1))
{
description.html(description.html().trim() + "...");
description.text(description.text().trim() + "...");
}
}

Expand Down
4 changes: 2 additions & 2 deletions delivery/common/js/views/PercTagListView.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -112,10 +112,10 @@
var query = JSON.parse( strJSON );
query.criteria.push("perc:tags = '" + tagEntry.tagName + "'");
var encodedQuery = "&query=" + encodeURIComponent(JSON.stringify(query));
newListElem.find("a").attr("href", baseURL + pageResult + "?filter="+tagEntry.tagName + encodedQuery).html(linkText);
newListElem.find("a").attr("href", baseURL + pageResult + "?filter="+encodeURIComponent(tagEntry.tagName) + encodedQuery).text(linkText);
}
else{
newListElem.find("a").html(linkText);
newListElem.find("a").text(linkText);
}
listRoot.append(newListElem);
}
Expand Down
Loading