Skip to content
This repository has been archived by the owner on May 7, 2020. It is now read-only.

Basic UI: escape HTML characters #3749

Merged
merged 1 commit into from Jul 3, 2017
Merged

Basic UI: escape HTML characters #3749

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
2 changes: 1 addition & 1 deletion ...basic/src/main/java/org/eclipse/smarthome/ui/basic/internal/render/SelectionRenderer.java
View file
Open in desktop
Expand Up @@ -67,7 +67,7 @@ public EList<Widget> renderWidget(Widget w, StringBuilder sb) throws RenderExcep
rowSnippet = StringUtils.replace(rowSnippet, "%item%", w.getItem() != null ? w.getItem() : "");
rowSnippet = StringUtils.replace(rowSnippet, "%cmd%", escapeHtml(command));
rowSnippet = StringUtils.replace(rowSnippet, "%label%",
mapping.getLabel() != null ? mapping.getLabel() : "");
mapping.getLabel() != null ? escapeHtml(mapping.getLabel()) : "");
if (state.equals(mapping.getCmd())) {
mappingLabel = mapping.getLabel();
rowSnippet = StringUtils.replace(rowSnippet, "%checked%", "checked=\"true\"");
Expand Down
5 changes: 3 additions & 2 deletions ...ui.basic/src/main/java/org/eclipse/smarthome/ui/basic/internal/render/SwitchRenderer.java
View file
Open in desktop
Expand Up @@ -81,8 +81,9 @@ public EList<Widget> renderWidget(Widget w, StringBuilder sb) throws RenderExcep
for (Mapping mapping : s.getMappings()) {
String button = getSnippet("button");
button = StringUtils.replace(button, "%item%", w.getItem());
button = StringUtils.replace(button, "%cmd%", mapping.getCmd());
button = StringUtils.replace(button, "%label%", escapeHtml(mapping.getLabel()));
button = StringUtils.replace(button, "%cmd%", escapeHtml(mapping.getCmd()));
button = StringUtils.replace(button, "%label%",
mapping.getLabel() != null ? escapeHtml(mapping.getLabel()) : "");
if (s.getMappings().size() > 1 && state.toString().equals(mapping.getCmd())) {
button = StringUtils.replace(button, "%class%", "mdl-button--accent");
} else {
Expand Down
30 changes: 16 additions & 14 deletions extensions/ui/org.eclipse.smarthome.ui.basic/web-src/smarthome.js
View file
Open in desktop
Expand Up @@ -606,7 +606,7 @@
_t.setValuePrivate = function(value, itemState) {
_t.value = "" + itemState;
if (_t.valueMap[itemState] !== undefined) {
_t.valueNode.innerHTML = _t.valueMap[itemState];
_t.valueNode.innerHTML = smarthome.UI.escapeHtml(_t.valueMap[itemState]);
} else {
_t.valueNode.innerHTML = "";
}
Expand Down Expand Up @@ -1398,23 +1398,25 @@
_t.iconType = document.body.getAttribute(o.iconTypeAttribute);
_t.notification = document.querySelector(o.notify);

_t.setTitle = function(title, needsEscape) {
_t.escapeHtml = function(text) {
var
escapedText = title,
escapedText = text,
escapeTable = [
[ /&/g, "&amp;" ],
[ /</g, "&lt;" ],
[ />/g, "&gt;" ]
];

if (needsEscape) {
for (var i = 0; i < escapeTable.length; i++) {
escapedText = escapedText.replace(escapeTable[i][0], escapeTable[i][1]);
}
for (var i = 0; i < escapeTable.length; i++) {
escapedText = escapedText.replace(escapeTable[i][0], escapeTable[i][1]);
}

document.querySelector("title").innerHTML = escapedText;
_t.layoutTitle.innerHTML = escapedText;
return escapedText;
};

_t.setTitle = function(title) {
document.querySelector("title").innerHTML = title;
_t.layoutTitle.innerHTML = title;
};

function replaceContent(xmlResponse) {
Expand All @@ -1433,7 +1435,7 @@
});

// HTML entities are already escaped on server
_t.setTitle(nodeArray[0].textContent, false);
_t.setTitle(nodeArray[0].textContent);

var
contentElement = document.querySelector(".page-content");
Expand Down Expand Up @@ -1718,7 +1720,7 @@
title = _t.getTitleFromLabel(data.label);

if ((data.widgetId === smarthome.UI.page) && (title !== null)) {
smarthome.UI.setTitle(title, true);
smarthome.UI.setTitle(smarthome.UI.escapeHtml(title));
} else if (smarthome.dataModel[data.widgetId] !== undefined) {
var
widget = smarthome.dataModel[data.widgetId];
Expand All @@ -1729,7 +1731,7 @@
visibility: data.visibility
});
} else {
widget.setValue(value, data.item.state);
widget.setValue(smarthome.UI.escapeHtml(value), data.item.state);
if (data.label !== undefined) {
widget.setLabel(data.label);
}
Expand Down Expand Up @@ -1774,7 +1776,7 @@

title = _t.getTitleFromLabel(response.title);
if (title !== null) {
smarthome.UI.setTitle(title, true);
smarthome.UI.setTitle(smarthome.UI.escapeHtml(title));
}

function walkWidgets(widgets) {
Expand All @@ -1798,7 +1800,7 @@
if (smarthome.dataModelLegacy[item] !== undefined) {
smarthome.dataModelLegacy[item].widgets.forEach(function(w) {
if (state !== "NULL") {
w.setValue(value, state);
w.setValue(smarthome.UI.escapeHtml(value), state);
}
if (label !== undefined) {
w.setLabel(label);
Expand Down