snoopdave opened a new pull request, #168:
URL: https://github.com/apache/roller/pull/168
Several authoring pages embed values in inline JavaScript string literals and
then write them into the page with jQuery `.html()`. This refactor moves
those
values into data attributes and writes them through text APIs, so JSPs stop
hand-concatenating markup and data.
## What changed
- Move server/user-controlled values out of inline JavaScript string literals
into double-quoted, HTML-escaped `data-*` attributes.
- Bind delegated event listeners that read values as text and assign them via
`textContent`, `.text()`, `.val()`, or DOM constructors.
- Replace the affected `.html()` writes with a text API.
- Use double-quoted attributes for weblog-content values in the media views.
- Cover templates, bookmarks/folders, categories, media
views/chooser/success,
entry lists, and entry editing, including the category iterator and
delete-modal cases.
- Render theme descriptions as text and make `ThemeDataServlet` return valid
JSON.
## Tests
- Values containing apostrophes, quotes, angle brackets, backslashes,
newlines,
and `</script>` remain text through each path.
- Cross-user authoring cases confirm one author's values stay text in another
author or administrator session.
- A source audit confirms no affected value remains in an inline literal, a
single-quoted attribute, or a `.html()` sink.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
