Merge pull request #327 from spadgett/3.6-sanitize-log

[enterprise-3.6] Sanitize HTML output for log viewer
openshift · Apr 12, 2018 · 66cc187 · 66cc187
2 parents cf4e6d6 + 3380b63
commit 66cc187
Show file tree

Hide file tree

Showing 4 changed files with 12 additions and 12 deletions.
diff --git a/dist/origin-web-common-ui.js b/dist/origin-web-common-ui.js
@@ -1904,7 +1904,7 @@ angular.module('openshiftCommonUI').factory('GuidedTourService', function() {
 ;'use strict';
 
 angular.module("openshiftCommonUI")
-  .factory("HTMLService", function(BREAKPOINTS) {
+  .factory("HTMLService", function($sanitize, BREAKPOINTS) {
     var WINDOW_SIZE_XXS = 'xxs';
     var WINDOW_SIZE_XS = 'xs';
     var WINDOW_SIZE_SM = 'sm';
@@ -2003,13 +2003,13 @@ angular.module("openshiftCommonUI")
         }
 
         // Replace any URLs with links.
-        return text.replace(/https?:\/\/[A-Za-z0-9._%+-]+\S*[^\s.;,(){}<>"\u201d\u2019]/gm, function(str) {
+        return $sanitize(text.replace(/https?:\/\/[A-Za-z0-9._%+-]+\S*[^\s.;,(){}<>"\u201d\u2019]/gm, function(str) {
           if (target) {
             return "<a href=\"" + str + "\" target=\"" + target + "\">" + str + "</a>";
           }
 
           return "<a href=\"" + str + "\">" + str + "</a>";
-        });
+        }));
       }
     };
   });

diff --git a/dist/origin-web-common.js b/dist/origin-web-common.js
@@ -5106,7 +5106,7 @@ angular.module('openshiftCommonUI').factory('GuidedTourService', function() {
 ;'use strict';
 
 angular.module("openshiftCommonUI")
-  .factory("HTMLService", ["BREAKPOINTS", function(BREAKPOINTS) {
+  .factory("HTMLService", ["$sanitize", "BREAKPOINTS", function($sanitize, BREAKPOINTS) {
     var WINDOW_SIZE_XXS = 'xxs';
     var WINDOW_SIZE_XS = 'xs';
     var WINDOW_SIZE_SM = 'sm';
@@ -5205,13 +5205,13 @@ angular.module("openshiftCommonUI")
         }
 
         // Replace any URLs with links.
-        return text.replace(/https?:\/\/[A-Za-z0-9._%+-]+\S*[^\s.;,(){}<>"\u201d\u2019]/gm, function(str) {
+        return $sanitize(text.replace(/https?:\/\/[A-Za-z0-9._%+-]+\S*[^\s.;,(){}<>"\u201d\u2019]/gm, function(str) {
           if (target) {
             return "<a href=\"" + str + "\" target=\"" + target + "\">" + str + "</a>";
           }
 
           return "<a href=\"" + str + "\">" + str + "</a>";
-        });
+        }));
       }
     };
   }]);

diff --git a/dist/origin-web-common.min.js b/dist/origin-web-common.min.js
@@ -2173,7 +2173,7 @@ return {
 startTour:startTour,
 cancelTour:cancelTour
 };
-}), angular.module("openshiftCommonUI").factory("HTMLService", [ "BREAKPOINTS", function(BREAKPOINTS) {
+}), angular.module("openshiftCommonUI").factory("HTMLService", [ "$sanitize", "BREAKPOINTS", function($sanitize, BREAKPOINTS) {
 var WINDOW_SIZE_XXS = "xxs", WINDOW_SIZE_XS = "xs", WINDOW_SIZE_SM = "sm", WINDOW_SIZE_MD = "md", WINDOW_SIZE_LG = "lg";
 return {
 WINDOW_SIZE_XXS:WINDOW_SIZE_XXS,
@@ -2224,9 +2224,9 @@ return !0;
 }
 },
 linkify:function(text, target, alreadyEscaped) {
-return text ? (alreadyEscaped || (text = _.escape(text)), text.replace(/https?:\/\/[A-Za-z0-9._%+-]+\S*[^\s.;,(){}<>"\u201d\u2019]/gm, function(str) {
+return text ? (alreadyEscaped || (text = _.escape(text)), $sanitize(text.replace(/https?:\/\/[A-Za-z0-9._%+-]+\S*[^\s.;,(){}<>"\u201d\u2019]/gm, function(str) {
 return target ? '<a href="' + str + '" target="' + target + '">' + str + "</a>" :'<a href="' + str + '">' + str + "</a>";
-})) :text;
+}))) :text;
 }
 };
 } ]), angular.module("openshiftCommonUI").provider("NotificationsService", function() {

diff --git a/src/ui-services/htmlService.js b/src/ui-services/htmlService.js
@@ -1,7 +1,7 @@
 'use strict';
 
 angular.module("openshiftCommonUI")
-  .factory("HTMLService", function(BREAKPOINTS) {
+  .factory("HTMLService", function($sanitize, BREAKPOINTS) {
     var WINDOW_SIZE_XXS = 'xxs';
     var WINDOW_SIZE_XS = 'xs';
     var WINDOW_SIZE_SM = 'sm';
@@ -100,13 +100,13 @@ angular.module("openshiftCommonUI")
         }
 
         // Replace any URLs with links.
-        return text.replace(/https?:\/\/[A-Za-z0-9._%+-]+\S*[^\s.;,(){}<>"\u201d\u2019]/gm, function(str) {
+        return $sanitize(text.replace(/https?:\/\/[A-Za-z0-9._%+-]+\S*[^\s.;,(){}<>"\u201d\u2019]/gm, function(str) {
           if (target) {
             return "<a href=\"" + str + "\" target=\"" + target + "\">" + str + "</a>";
           }
 
           return "<a href=\"" + str + "\">" + str + "</a>";
-        });
+        }));
       }
     };
   });