🔒️ Resolve security alerts

assets/js/util.js

@@ -96,7 +96,7 @@
 
 			// Expand "target" if it's not a jQuery object already.
 				if (typeof config.target != 'jQuery')
-					config.target = $(config.target);
+					config.target = $.find(config.target);
 
 		// Panel.
 

docs/_sources/_static/doctools.js

@@ -9,6 +9,13 @@
  *
  */
 
+const BLACKLISTED_KEY_CONTROL_ELEMENTS = new Set([
+  "TEXTAREA",
+  "INPUT",
+  "SELECT",
+  "BUTTON",
+]);
+
 /**
  * select a different prefix for underscore
  */
@@ -233,6 +240,14 @@ var Documentation = {
 // quick alias for translations
 _ = Documentation.gettext;
 
+const _ready = (callback) => {
+  if (document.readyState !== "loading") {
+    callback();
+  } else {
+    document.addEventListener("DOMContentLoaded", callback);
+  }
+};
+
 $(document).ready(function() {
   Documentation.init();
 });

docs/_sources/_static/versionList.js

@@ -1,9 +1,48 @@
 const versionPattern = /(?<=.*fcp-indi\.github\..*\/docs\/)(.*)(?=\/.*)/;
 
+function fetchValidVersions() {
+  return fetch("https://fcp-indi.github.io/docs/versions.txt")
+    .then(response => response.text())
+    .then(version_list => version_list.split('\n').filter(v => v.trim() !== ''));
+}
+
+function validateDomain(here, selectedLocation) {
+  const currentDomain = new URL(here).origin;
+  const newDomain = new URL(selectedLocation).origin;
+  if (currentDomain !== newDomain) {
+    console.error("Redirect URL is not in the same domain:", selectedLocation);
+    return false;
+  }
+  return true;
+}
+
+
+function validateAndRedirect(here, version) {
+  fetchValidVersions().then(validVersions => {
+    // Construct the redirect URL
+    const indexInString = here.search(versionPattern);
+    let suffix = here.slice(indexInString, here.length).split('\/');
+    suffix = '/' + suffix.slice(1, suffix.length).join('\/');
+    const selectedVersion = here.slice(0, indexInString) + version;
+    const selectedLocation = selectedVersion + suffix;
+
+    // Validate the version parameter
+    if (!validVersions.includes(version)) {
+      console.error("Invalid version selected:", version);
+      return; // Do not proceed with the redirect
+    }
+
+    if ((selectedLocation !== here) && validateDomain(here, selectedLocation)) {
+      const redirectURL = new URL(selectedLocation);
+      // Perform the redirect if the URL is different and version is valid
+      window.location.replace(redirectURL);
+    }
+  });
+}
+
 function createDropdown(here) {
   let promisedDropdown = function(resolve, reject) {
-    fetch("https://fcp-indi.github.io/docs/versions.txt").then(response => response.text().then(version_list => {
-      const versions = version_list.split('\n');
+    fetchValidVersions().then(versions => {
       let dropdownElement = document.createElement('select');
       versions.forEach(version => {
         let option = document.createElement('option');
@@ -16,48 +55,41 @@ function createDropdown(here) {
         }
       });
       resolve(dropdownElement);
-    }));
+    });
   }
   return new Promise(promisedDropdown);
 }
 
 function versionDropdown() {
   const here = window.location.href;
-  const dochome = "https://" + here.split('/').slice(2, 5).join('/');
-  const navTitles = document.querySelectorAll(".brand,.sidebar-brand-text");
-  createDropdown(here).then(dropdown => {
-    for (let item of navTitles) {
-      item.parentElement.removeAttribute("href");
-      let newTitle = document.createElement("div");
-      let newTitlePrefix = document.createElement("a");
-      newTitlePrefix.setAttribute("href", dochome);
-      newTitlePrefix.appendChild(document.createTextNode("C-PAC "));
-      newTitle.appendChild(newTitlePrefix);
-      newTitle.appendChild(dropdown);
-      let newTitleSuffix = document.createElement("a");
-      newTitleSuffix.setAttribute("href", dochome);
-      newTitleSuffix.appendChild(document.createTextNode(" documentation"));
-      newTitle.appendChild(newTitleSuffix);
-      newTitle.appendChild(document.createTextNode(" »"));
-      item.innerHTML = newTitle.innerHTML;
-      item.addEventListener('change', (event) => {
-        redirectVersion(here, event.target.value);
-      });
-    }
-  });
-}
-
-
-function redirectVersion(here, version) {
-  const indexInString = here.search(versionPattern);
-  let suffix = here.slice(indexInString, here.length).split('\/');
-  suffix = '/' + suffix.slice(1,suffix.length).join('\/');
-  const selectedLocation = here.slice(0, indexInString) + version + suffix;
-  if (selectedLocation !== here) {
-    window.location.replace(selectedLocation);
+  const dochome = new URL("https://" + here.split('/').slice(2, 5).join('/'));
+  if (validateDomain(here, dochome)) {
+    const navTitles = document.querySelectorAll(".brand,.sidebar-brand-text");
+    createDropdown(here).then(dropdown => {
+      for (let item of navTitles) {
+        item.parentElement.removeAttribute("href");
+        let newTitle = document.createElement("div");
+        let newTitlePrefix = document.createElement("a");
+        if (dochome.origin === window.location.origin) {
+          newTitlePrefix.setAttribute("href", dochome);
+        }
+        newTitlePrefix.appendChild(document.createTextNode("C-PAC "));
+        newTitle.appendChild(newTitlePrefix);
+        newTitle.appendChild(dropdown);
+        let newTitleSuffix = document.createElement("a");
+        if (dochome.origin === window.location.origin) {
+          newTitleSuffix.setAttribute("href", dochome);
+        }
+        newTitleSuffix.appendChild(document.createTextNode(" documentation"));
+        newTitle.appendChild(newTitleSuffix);
+        newTitle.appendChild(document.createTextNode(" »"));
+        item.innerHTML = newTitle.innerHTML;
+        item.addEventListener('change', (event) => {
+          validateAndRedirect(here, event.target.value);
+        });
+      }
+    });
   }
 }
 
-
-
-versionDropdown();
+versionDropdown();

docs/_sources/_templates/layout.html → docs/_sources/_templates/page.html

@@ -1,4 +1,9 @@
-{% extends "!layout.html" %}
+{% extends "!page.html" %}
+
+{% block extrahead %}
+{{ super() }}
+<script src="{{ pathto('_static/underscore.js', 1) }}"></script>
+{% endblock %}
 
 {% block footer %}
 {{ super() }}

docs/_sources/conf.py

@@ -491,8 +491,6 @@ def _unireplace(release_note, unireplace):
     'custom.css',
 ]
 html_js_files = [
-    'underscore.js',
-    'doctools.js',
     'hideEmptyHighlights.js',
     ('versionList.js', {'defer': 'defer'})]
 

docs/_sources/user/versions.rst

@@ -47,15 +47,15 @@ fMRIPrep-LTS variant
 
 .. |example version| replace:: |version as code|
 
-.. |latest-primary-badge| image:: https://img.shields.io/badge/last_published_version-C--PAC_1.8.7-green
-   :target: https://hub.docker.com/layers/fcpindi/c-pac/release-v1.8.7/images/sha256-590200a9f6b87e4c67a7b19627f332d54fab94a54c0fc5ed709d6fa31017569f
+.. |latest-primary-badge| image:: https://img.shields.io/badge/last_published_version-C--PAC_1.8.7.post1.dev3-green
+   :target: https://hub.docker.com/layers/fcpindi/c-pac/release-v1.8.7.post1.dev3/images/sha256-7122e5cbeea5ac68a6f2e79584677ca7bf9cdebcf705536c2b93782074b925e7
 
-.. |latest-lite-badge| image:: https://img.shields.io/badge/last_published_version-C--PAC_1.8.7-green
-   :target: https://hub.docker.com/layers/fcpindi/c-pac/release-v1.8.7-lite/images/sha256-7e983fdf82a005509c96cee3aa90755e2783d9c8835a46cabacf94540ddb9f3a
+.. |latest-lite-badge| image:: https://img.shields.io/badge/last_published_version-C--PAC_1.8.7.post1.dev3-green
+   :target: https://hub.docker.com/layers/fcpindi/c-pac/release-v1.8.7.post1.dev3-lite/images/sha256-31ab0fcc90276e5751addee506907a62bcc628e75ce9ab87adee623b961b6a8e
 
 .. |nightly-badge| image:: https://img.shields.io/badge/development_version-C--PAC_nightly-green
-   :target: https://hub.docker.com/layers/fcpindi/c-pac/nightly/images/sha256-779c148e491dda7120dbf5b667bf7d86e81282d56fae67c5d3c5be2ecd6618b0
-
+   :target: https://hub.docker.com/layers/fcpindi/c-pac/nightly/images/sha256-287cb872b7263e63bbf7770e3cc31b54890fde9af4fe5010f0a99e36fb1bfdf4
+         
 .. |nightly-lite-badge| image:: https://img.shields.io/badge/development_version-C--PAC_nightly-green
-   :target: https://hub.docker.com/layers/fcpindi/c-pac/nightly-lite/images/sha256-2cbbc07e601f1530846143ccb74ff6b8e64f04f7f19ff7f84ff8dcc5c91be639
-
+   :target: https://hub.docker.com/layers/fcpindi/c-pac/nightly-lite/images/sha256-dcf70cbe77b4166458b3d40bf9cab9e030b7ad24a06a1ee7e5ed335100f9cbcc
+         

index.html

@@ -4,6 +4,7 @@
 		<title>International Neuroimaging Data-sharing Initiative</title>
 		<meta charset="utf-8" />
 		<meta name="viewport" content="width=device-width, initial-scale=1" />
+		<script src="https://fcp-indi.github.io/docs/latest/_static/underscore.js"></script>
 		<!--[if lte IE 8]><script src="assets/js/ie/html5shiv.js"></script><![endif]-->
 		<link rel="stylesheet" href="assets/css/main.css" />
 		<!--[if lte IE 8]><link rel="stylesheet" href="assets/css/ie8.css" /><![endif]-->

requirements.txt

@@ -3,7 +3,7 @@ dataclasses; python_version < '3.7'
 docutils>=0.8
 importlib-metadata>=3.6; python_version < '3.10'
 ipython
-Jinja2<3.1
+Jinja2>=3.1.6
 m2r
 mistune==0.8.4
 nbsphinx

scripts/version_list.py

@@ -1,4 +1,5 @@
 import os
+from pathlib import Path
 import sys
 
 
@@ -7,9 +8,15 @@ def rewrite_versions(docs_path='/build/docs'):
     Collects built versions and outputs a text file that lists 'latest',
     latest version number, 'nightly', descending prior verions.
     """
-    versions_txt_path = os.path.join(docs_path, 'versions.txt')
-    with open(versions_txt_path, 'w') as vtp:
-        vtp.write('\n'.join(sort_versions(os.listdir(docs_path))))
+    docs_path = Path(docs_path)
+    versions_txt_path = docs_path.joinpath('versions.txt')
+    versions_urls_path = docs_path.joinpath('versions_urls.txt')
+    versions = sort_versions(os.listdir(docs_path))
+    with versions_txt_path.open("w") as vtp:
+        vtp.write('\n'.join(versions))
+    with versions_urls_path.open("w") as vup:
+        vup.write('\n'.join([f'https://fcp-indi.github.io/docs/{v}' for v in versions]))
+
 
 
 def sort_versions(versions):