Skip to content

Datepicker: Make sure text option are text, shorten HTML strings #1953

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 2 commits into from
May 11, 2021
Merged

Datepicker: Make sure text option are text, shorten HTML strings #1953

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
7cd8b25
Datepicker: Make sure text option are text, shorten HTML strings
mgol Apr 25, 2021
463654d
fixup! Datepicker: Make sure text option are text, shorten HTML strings
mgol May 7, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
51 changes: 51 additions & 0 deletions tests/unit/datepicker/options.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1171,4 +1171,55 @@ QUnit.test( "Ticket 7602: Stop datepicker from appearing with beforeShow event h
inp.datepicker( "destroy" );
} );

QUnit.test( "Ticket #15284: escaping text parameters", function( assert ) {
assert.expect( 7 );

var done = assert.async();

var qf = $( "#qunit-fixture" );

window.uiGlobalXss = [];

var inp = testHelper.init( "#inp", {
showButtonPanel: true,
showOn: "both",
prevText: "<script>uiGlobalXss = uiGlobalXss.concat( [ 'prevText XSS' ] )</script>",
nextText: "<script>uiGlobalXss = uiGlobalXss.concat( [ 'nextText XSS' ] )</script>",
currentText: "<script>uiGlobalXss = uiGlobalXss.concat( [ 'currentText XSS' ] )</script>",
closeText: "<script>uiGlobalXss = uiGlobalXss.concat( [ 'closeText XSS' ] )</script>",
buttonText: "<script>uiGlobalXss = uiGlobalXss.concat( [ 'buttonText XSS' ] )</script>",
appendText: "<script>uiGlobalXss = uiGlobalXss.concat( [ 'appendText XSS' ] )</script>"
} );

var dp = $( "#ui-datepicker-div" );

testHelper.onFocus( inp, function() {
assert.equal( dp.find( ".ui-datepicker-prev" ).text().trim(),
"<script>uiGlobalXss = uiGlobalXss.concat( [ 'prevText XSS' ] )</script>",
"prevText escaped" );
assert.equal( dp.find( ".ui-datepicker-next" ).text().trim(),
"<script>uiGlobalXss = uiGlobalXss.concat( [ 'nextText XSS' ] )</script>",
"nextText escaped" );
assert.equal( dp.find( ".ui-datepicker-current" ).text().trim(),
"<script>uiGlobalXss = uiGlobalXss.concat( [ 'currentText XSS' ] )</script>",
"currentText escaped" );
assert.equal( dp.find( ".ui-datepicker-close" ).text().trim(),
"<script>uiGlobalXss = uiGlobalXss.concat( [ 'closeText XSS' ] )</script>",
"closeText escaped" );

assert.equal( qf.find( ".ui-datepicker-trigger" ).text().trim(),
"<script>uiGlobalXss = uiGlobalXss.concat( [ 'buttonText XSS' ] )</script>",
"buttonText escaped" );
assert.equal( qf.find( ".ui-datepicker-append" ).text().trim(),
"<script>uiGlobalXss = uiGlobalXss.concat( [ 'appendText XSS' ] )</script>",
"appendText escaped" );

assert.deepEqual( window.uiGlobalXss, [], "No XSS" );

delete window.uiGlobalXss;
inp.datepicker( "hide" ).datepicker( "destroy" );
done();
} );
} );

} );
136 changes: 115 additions & 21 deletions ui/widgets/datepicker.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -240,7 +240,9 @@ $.extend( Datepicker.prototype, {
inst.append.remove();
}
if ( appendText ) {
inst.append = $( "<span class='" + this._appendClass + "'>" + appendText + "</span>" );
inst.append = $( "<span></span>" )
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Closing tag is not needed here.

.attr( "class", this._appendClass )
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why not using addClass here?

.text( appendText );
input[ isRTL ? "before" : "after" ]( inst.append );
}

Expand All @@ -257,12 +259,32 @@ $.extend( Datepicker.prototype, {
if ( showOn === "button" || showOn === "both" ) { // pop-up date picker when button clicked
buttonText = this._get( inst, "buttonText" );
buttonImage = this._get( inst, "buttonImage" );
inst.trigger = $( this._get( inst, "buttonImageOnly" ) ?
$( "<img/>" ).addClass( this._triggerClass ).
attr( { src: buttonImage, alt: buttonText, title: buttonText } ) :
$( "<button type='button'></button>" ).addClass( this._triggerClass ).
html( !buttonImage ? buttonText : $( "<img/>" ).attr(
{ src:buttonImage, alt:buttonText, title:buttonText } ) ) );

if ( this._get( inst, "buttonImageOnly" ) ) {
inst.trigger = $( "<img/>" )
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Remove slash for closing as not needed.

.addClass( this._triggerClass )
.attr( {
src: buttonImage,
alt: buttonText,
title: buttonText
} );
} else {
inst.trigger = $( "<button type='button'></button>" )
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Closing tag not needed.

.addClass( this._triggerClass );
if ( buttonImage ) {
inst.trigger.html(
$( "<img/>" )
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

See comment above.

.attr( {
src: buttonImage,
alt: buttonText,
title: buttonText
} )
);
} else {
inst.trigger.text( buttonText );
}
}

input[ isRTL ? "before" : "after" ]( inst.trigger );
inst.trigger.on( "click", function() {
if ( $.datepicker._datepickerShowing && $.datepicker._lastInput === input[ 0 ] ) {
Expand Down Expand Up @@ -1703,32 +1725,104 @@ $.extend( Datepicker.prototype, {
this._daylightSavingAdjust( new Date( drawYear, drawMonth - stepMonths, 1 ) ),
this._getFormatConfig( inst ) ) );

prev = ( this._canAdjustMonth( inst, -1, drawYear, drawMonth ) ?
"<a class='ui-datepicker-prev ui-corner-all' data-handler='prev' data-event='click'" +
" title='" + prevText + "'><span class='ui-icon ui-icon-circle-triangle-" + ( isRTL ? "e" : "w" ) + "'>" + prevText + "</span></a>" :
( hideIfNoPrevNext ? "" : "<a class='ui-datepicker-prev ui-corner-all ui-state-disabled' title='" + prevText + "'><span class='ui-icon ui-icon-circle-triangle-" + ( isRTL ? "e" : "w" ) + "'>" + prevText + "</span></a>" ) );
if ( this._canAdjustMonth( inst, -1, drawYear, drawMonth ) ) {
prev = $( "<a></a>" )
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

"<a>" should be enough or is there a reason you added the closing tag here?

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The string I used is natively compliant with both HTML & XHTML, although for the single tag case it doesn't matter much as jQuery uses a shortcut that just does document.createElement then. I can change it to "<a>".

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Using <a> would be more consistent with what we have in other (more modern, UI widget factory using) widgets.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@fnagel Although it's safe to do a single unclosed tag, an unclosed tag with attributes or several unclosed tags in a string can be an issue. It's been hard to explain these subtle differences to people so closing tags is a good practice.

I guess another option would be <a /> which jQuery also shortcuts to document.createElement? Not sure if that's better or not.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@dmethvin Sadly, the linked news does not provide a recommendation what is the best practice. Looks like best thing to do is using closed tags, right?

I would suggest to keep this consistent with all other widgets (using single, unclosed tags if no attributes are used) and then do a PR changing this to single closed tags.

Copy link
Member Author

@mgol mgol May 4, 2021 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The code deciding on whether to use the shortcut or not is here:
https://github.com/jquery/jquery/blob/a70274632dc19ff4a64d7bb7657a2cc647ff38b9/src/core/parseHTML.js#L35-L43
If the regex matches, the simple route is chosen. As Dave mention, just adding an attribute will break it, though, which makes $("<div>") work fine in XHTML mode but $("<div a='b'>") break. It's safer to always close tags for this reason. $("<div a='b' />") would work, though - in HTML mode the slash is ignored and in XHTML mode all tags can be self-closing. Because /> is generally just > in HTML mode, though, the fact that it works is a bit magical. But maybe that's fine.

I'm fine with making the change here as advised and modifying all single tags separately in a subsequent PR.

.attr( {
"class": "ui-datepicker-prev ui-corner-all",
"data-handler": "prev",
"data-event": "click",
title: prevText
} )
.append(
$( "<span>" )
.attr( "class", "ui-icon ui-icon-circle-triangle-" +
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why not using addClass here?

( isRTL ? "e" : "w" ) )
.text( prevText )
)[ 0 ].outerHTML;
} else if ( hideIfNoPrevNext ) {
prev = "";
} else {
prev = $( "<a></a>" )
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

See comment above.

.attr( {
"class": "ui-datepicker-prev ui-corner-all ui-state-disabled",
title: prevText
} )
.append(
$( "<span>" )
.attr( "class", "ui-icon ui-icon-circle-triangle-" +
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why not using addClass here?

( isRTL ? "e" : "w" ) )
.text( prevText )
)[ 0 ].outerHTML;
}

nextText = this._get( inst, "nextText" );
nextText = ( !navigationAsDateFormat ? nextText : this.formatDate( nextText,
this._daylightSavingAdjust( new Date( drawYear, drawMonth + stepMonths, 1 ) ),
this._getFormatConfig( inst ) ) );

next = ( this._canAdjustMonth( inst, +1, drawYear, drawMonth ) ?
"<a class='ui-datepicker-next ui-corner-all' data-handler='next' data-event='click'" +
" title='" + nextText + "'><span class='ui-icon ui-icon-circle-triangle-" + ( isRTL ? "w" : "e" ) + "'>" + nextText + "</span></a>" :
( hideIfNoPrevNext ? "" : "<a class='ui-datepicker-next ui-corner-all ui-state-disabled' title='" + nextText + "'><span class='ui-icon ui-icon-circle-triangle-" + ( isRTL ? "w" : "e" ) + "'>" + nextText + "</span></a>" ) );
if ( this._canAdjustMonth( inst, +1, drawYear, drawMonth ) ) {
next = $( "<a></a>" )
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

See comment above.

.attr( {
"class": "ui-datepicker-next ui-corner-all",
"data-handler": "next",
"data-event": "click",
title: nextText
} )
.append(
$( "<span>" )
.attr( "class", "ui-icon ui-icon-circle-triangle-" +
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why not using addClass here?

( isRTL ? "w" : "e" ) )
.text( nextText )
)[ 0 ].outerHTML;
} else if ( hideIfNoPrevNext ) {
next = "";
} else {
next = $( "<a></a>" )
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

See comment above.

.attr( {
"class": "ui-datepicker-next ui-corner-all ui-state-disabled",
title: nextText
} )
.append(
$( "<span>" )
.attr( "class", "ui-icon ui-icon-circle-triangle-" +
( isRTL ? "w" : "e" ) )
.text( nextText )
)[ 0 ].outerHTML;
}

currentText = this._get( inst, "currentText" );
gotoDate = ( this._get( inst, "gotoCurrent" ) && inst.currentDay ? currentDate : today );
currentText = ( !navigationAsDateFormat ? currentText :
this.formatDate( currentText, gotoDate, this._getFormatConfig( inst ) ) );

controls = ( !inst.inline ? "<button type='button' class='ui-datepicker-close ui-state-default ui-priority-primary ui-corner-all' data-handler='hide' data-event='click'>" +
this._get( inst, "closeText" ) + "</button>" : "" );

buttonPanel = ( showButtonPanel ) ? "<div class='ui-datepicker-buttonpane ui-widget-content'>" + ( isRTL ? controls : "" ) +
( this._isInRange( inst, gotoDate ) ? "<button type='button' class='ui-datepicker-current ui-state-default ui-priority-secondary ui-corner-all' data-handler='today' data-event='click'" +
">" + currentText + "</button>" : "" ) + ( isRTL ? "" : controls ) + "</div>" : "";
controls = "";
if ( !inst.inline ) {
controls = $( "<button></button>" )
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Same here: is there a reason you added the closing tag?

.attr( {
type: "button",
"class": "ui-datepicker-close ui-state-default ui-priority-primary ui-corner-all",
"data-handler": "hide",
"data-event": "click"
} )
.text( this._get( inst, "closeText" ) )[ 0 ].outerHTML;
}

buttonPanel = "";
if ( showButtonPanel ) {
buttonPanel = $( "<div class='ui-datepicker-buttonpane ui-widget-content'>" )
.append( isRTL ? controls : "" )
.append( this._isInRange( inst, gotoDate ) ?
$( "<button></button>" )
.attr( {
type: "button",
"class": "ui-datepicker-current ui-state-default ui-priority-secondary ui-corner-all",
"data-handler": "today",
"data-event": "click"
} )
.text( currentText ) :
"" )
.append( isRTL ? "" : controls )[ 0 ].outerHTML;
}

firstDay = parseInt( this._get( inst, "firstDay" ), 10 );
firstDay = ( isNaN( firstDay ) ? 0 : firstDay );
Expand Down