From 8a6415ef5f38d6ef6292858acd0a43fdfa81049f Mon Sep 17 00:00:00 2001 From: El RIDO Date: Fri, 31 Jan 2020 22:42:42 +0100 Subject: [PATCH] fixing jsverify rngStates 0220439df7ec68a15b, 015c81b7afd06e4293 & 041e3d57692b08fc4a --- js/privatebin.js | 4 ++-- js/test/AttachmentViewer.js | 2 +- js/test/I18n.js | 23 ++++++++++++----------- tpl/bootstrap.php | 2 +- tpl/page.php | 2 +- 5 files changed, 17 insertions(+), 16 deletions(-) diff --git a/js/privatebin.js b/js/privatebin.js index 9250b8e7..b0d60eb8 100644 --- a/js/privatebin.js +++ b/js/privatebin.js @@ -630,7 +630,7 @@ jQuery.PrivateBin = (function($, RawDeflate) { let containsLinks = args[0].indexOf(' 0) may never contain HTML as they may come from untrusted parties if (i > 0 || !containsLinks) { @@ -657,7 +657,7 @@ jQuery.PrivateBin = (function($, RawDeflate) { $element.html(output); } else { // text node takes care of entity encoding - $element.text(output); + $element.text(output); } return ''; } diff --git a/js/test/AttachmentViewer.js b/js/test/AttachmentViewer.js index 842945fc..0cf89a30 100644 --- a/js/test/AttachmentViewer.js +++ b/js/test/AttachmentViewer.js @@ -86,7 +86,7 @@ describe('AttachmentViewer', function () { $.PrivateBin.AttachmentViewer.moveAttachmentTo(element, prefix + '%s' + postfix); // messageIDs with links get a relaxed treatment if (prefix.indexOf('').text((prefix + filename + postfix)).text(); } else { result = prefix + $.PrivateBin.Helper.htmlEntities(filename) + postfix; } diff --git a/js/test/I18n.js b/js/test/I18n.js index 0086cc27..67b1ca94 100644 --- a/js/test/I18n.js +++ b/js/test/I18n.js @@ -89,19 +89,20 @@ describe('I18n', function () { prefix = prefix.replace(/%(s|d)/g, '%%'); params[0] = params[0].replace(/%(s|d)/g, '%%').replace(/').text((prefix + params[0] + postfix)).text(); + let args = Array.prototype.slice.call(params); + args.unshift(prefix + '%s' + postfix); let clean = jsdom(); $('body').html('
'); - params.unshift($('#i18n')); - $.PrivateBin.I18n.translate.apply(this, params); + args.unshift($('#i18n')); + $.PrivateBin.I18n.translate.apply(this, args); const result = $('#i18n').text(); $.PrivateBin.I18n.reset(); clean(); clean = jsdom(); $('body').html('
'); - params[0] = $('#i18n'); - $.PrivateBin.I18n._.apply(this, params); + args[0] = $('#i18n'); + $.PrivateBin.I18n._.apply(this, args); const alias = $('#i18n').text(); $.PrivateBin.I18n.reset(); clean(); @@ -114,15 +115,15 @@ describe('I18n', function () { '(small nearray) string', 'string', function (prefix, params, postfix) { - prefix = prefix.replace(/%(s|d)/g, '%%'); - params[0] = params[0].replace(/%(s|d)/g, '%%'); - postfix = postfix.replace(/%(s|d)/g, '%%'); - const translation = $('
').html(DOMPurify.sanitize( + prefix = prefix.replace(/%(s|d)/g, '%%').trim(); + params[0] = params[0].replace(/%(s|d)/g, '%%').trim(); + postfix = postfix.replace(/%(s|d)/g, '%%').trim(); + const translation = DOMPurify.sanitize( prefix + $.PrivateBin.Helper.htmlEntities(params[0]) + '' + postfix, { ALLOWED_TAGS: ['a', 'br', 'i', 'span'], ALLOWED_ATTR: ['href', 'id'] } - )).html(); + ); let args = Array.prototype.slice.call(params); args.unshift(prefix + '%s' + postfix); let clean = jsdom(); diff --git a/tpl/bootstrap.php b/tpl/bootstrap.php index 427b61c3..74338ea8 100644 --- a/tpl/bootstrap.php +++ b/tpl/bootstrap.php @@ -72,7 +72,7 @@ endif; ?> - + diff --git a/tpl/page.php b/tpl/page.php index 5cde1242..9a512e19 100644 --- a/tpl/page.php +++ b/tpl/page.php @@ -50,7 +50,7 @@ endif; ?> - +