Skip to content

Commit 4820fdc

Browse files
nanotechnanotech
committed
Add CSPs to mitigate XSS via inline scripts and styles
All inline scripts and styles have been moved into external files so policies without 'unsafe-inline' can be applied.
1 parent 5f3975d commit 4820fdc

File tree

17 files changed

+209
-125
lines changed

17 files changed

+209
-125
lines changed

‎Resources/html/css/GitX.css

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -31,3 +31,7 @@ table {
3131
font-family: Menlo, Monaco, monospace;
3232
text-decoration: none;
3333
}
34+
35+
.hidden {
36+
display: none;
37+
}

‎Resources/html/lib/GitX.js

Lines changed: 9 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -35,25 +35,26 @@ Array.prototype.indexOf = function(item, i) {
3535

3636
var notify = function(html, state) {
3737
var n = $("notification");
38-
n.style.display = "";
38+
n.classList.remove("hidden");
3939
$("notification_message").innerHTML = html;
4040

4141
// Change color
4242
if (!state) { // Busy
43-
$("spinner").style.display = "";
44-
n.setAttribute("class", "");
43+
$("spinner").classList.remove("hidden");
44+
n.classList.remove("success");
45+
n.classList.remove("fail");
4546
}
4647
else if (state == 1) { // Success
47-
$("spinner").style.display = "none";
48-
n.setAttribute("class", "success");
48+
$("spinner").classList.add("hidden");
49+
n.classList.add("success");
4950
} else if (state == -1) {// Fail
50-
$("spinner").style.display = "none";
51-
n.setAttribute("class", "fail");
51+
$("spinner").classList.add("hidden");
52+
n.classList.add("fail");
5253
}
5354
}
5455

5556
var hideNotification = function() {
56-
$("notification").style.display = "none";
57+
$("notification").classList.add("hidden");
5758
}
5859

5960
var bindCommitSelectionLinks = function(el) {

‎Resources/html/views/blame/index.html

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,7 @@
11
<html>
22
<head>
3+
<meta charset="utf-8">
4+
<meta http-equiv="Content-Security-Policy" content="default-src 'none'; script-src 'self'; style-src 'self';">
35
<script src="../../lib/GitX.js" type="text/javascript" charset="utf-8"></script>
46
<script src="../../lib/syntaxhighlighter/scripts/shCore.js" type="text/javascript" charset="utf-8"></script>
57
<script src="../../lib/syntaxhighlighter/scripts/shBrushObjC.js" type="text/javascript" charset="utf-8"></script>
@@ -11,4 +13,4 @@
1113
<body>
1214
<div id="txt">hola</pre>
1315
</body>
14-
</html>
16+
</html>

‎Resources/html/views/commit/commit.js

Lines changed: 48 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -112,8 +112,8 @@ var setSelectHandlers = function()
112112
if (file.id = "selected")
113113
file = file.parentNode;
114114
var start = target;
115-
var elem_class = start.getAttribute("class");
116-
if(!elem_class || !(elem_class == "addline" | elem_class == "delline"))
115+
var elemClasses = start.classList;
116+
if (!(elemClasses.contains("addline") || elemClasses.contains("delline")))
117117
return false;
118118
deselect();
119119
var bounds = findsubhunk(start);
@@ -122,11 +122,11 @@ var setSelectHandlers = function()
122122
};
123123

124124
file.onmousedown = function(event) {
125-
if (event.which != 1)
125+
if (event.which != 1)
126126
return false;
127-
var elem_class = event.target.getAttribute("class")
127+
var elemClasses = event.target.classList;
128128
event.stopPropagation();
129-
if (elem_class == "hunkheader" || elem_class == "hunkbutton")
129+
if (elemClasses.contains("hunkheader") || elemClasses.contains("hunkbutton"))
130130
return false;
131131

132132
var target = findParentElementByTag(event.target, "div");
@@ -202,11 +202,26 @@ var displayDiff = function(diff, cached)
202202

203203
for (i = 0; i < hunkHeaders.length; ++i) {
204204
var header = hunkHeaders[i];
205-
if (cached)
206-
header.innerHTML = "<a href='#' class='hunkbutton' onclick='addHunk(this, true); return false'>Unstage</a>" + header.innerHTML;
205+
if (cached) {
206+
header.innerHTML = "<a href='#' class='hunkbutton unstage-button'>Unstage</a>" + header.innerHTML;
207+
header.getElementsByClassName('unstage-button')[0].addEventListener("click", function(e) {
208+
e.preventDefault();
209+
addHunk(this, true);
210+
});
211+
}
207212
else {
208-
header.innerHTML = "<a href='#' class='hunkbutton' onclick='discardHunk(this, event); return false'>Discard</a>" + header.innerHTML;
209-
header.innerHTML = "<a href='#' class='hunkbutton' onclick='addHunk(this, false); return false'>Stage</a>" + header.innerHTML;
213+
header.innerHTML =
214+
"<a href='#' class='hunkbutton add-hunk-button'>Stage</a>" +
215+
"<a href='#' class='hunkbutton discard-hunk-button'>Discard</a>" +
216+
header.innerHTML;
217+
header.getElementsByClassName("add-hunk-button")[0].addEventListener("click", function(e) {
218+
e.preventDefault();
219+
addHunk(this, false);
220+
});
221+
header.getElementsByClassName("discard-hunk-button")[0].addEventListener("click", function(e) {
222+
e.preventDefault();
223+
discardHunk(this, event);
224+
});
210225
}
211226
}
212227
setSelectHandlers();
@@ -275,19 +290,19 @@ var discardHunk = function(hunk, event)
275290

276291
/* Find all contiguous add/del lines. A quick way to select "just this
277292
* chunk". */
278-
var findsubhunk = function(start) {
279-
var findBound = function(direction) {
293+
var findsubhunk = function(start) {
294+
var findBound = function(direction) {
280295
var element=start;
281-
for (var next = element[direction]; next; next = next[direction]) {
282-
var elem_class = next.getAttribute("class");
283-
if (elem_class == "hunkheader" || elem_class == "noopline")
284-
break;
296+
for (var next = element[direction]; next; next = next[direction]) {
297+
var elemClasses = next.classList;
298+
if (elemClasses.contains("hunkheader") || elemClasses.contains("noopline"))
299+
break;
285300
element=next;
286301
}
287-
return element;
288-
}
289-
return [findBound("previousSibling"), findBound("nextSibling")];
290-
}
302+
return element;
303+
}
304+
return [findBound("previousSibling"), findBound("nextSibling")];
305+
}
291306

292307
/* Remove existing selection */
293308
var deselect = function() {
@@ -306,11 +321,10 @@ var stageLines = function(reverse) {
306321
if(!selection) return false;
307322
currentSelection = false;
308323
var hunkHeader = false;
309-
var preselect = 0,elem_class;
324+
var preselect = 0;
310325

311326
for(var next = selection.previousSibling; next; next = next.previousSibling) {
312-
elem_class = next.getAttribute("class");
313-
if(elem_class == "hunkheader") {
327+
if (next.classList.contains("hunkheader")) {
314328
hunkHeader = next.lastChild.data;
315329
break;
316330
}
@@ -395,13 +409,13 @@ var computeSelection = function(list, from, to)
395409
insel = true;
396410
}
397411

398-
var elem_class = elem.getAttribute("class");
399-
if(elem_class) {
400-
if(elem_class == "hunkheader") {
412+
var elemClasses = elem.classList;
413+
if (elem.className) {
414+
if (elemClasses.contains("hunkheader")) {
401415
elem = last;
402416
break; // Stay inside this hunk
403417
}
404-
if(!good && (elem_class == "addline" || elem_class == "delline"))
418+
if (!good && (elemClasses.contains("addline") || elemClasses.contains("delline")))
405419
good = true; // A good selection
406420
}
407421
if (elem == to) break;
@@ -489,10 +503,14 @@ var showSelection = function(file, from, to, trust)
489503
buttons_div.appendChild(copy_button);
490504

491505
if (sel.good) {
492-
button.setAttribute('onclick','stageLines('+
493-
(originalCached?'true':'false')+
494-
'); return false;');
495-
copy_button.setAttribute('onclick','copy(); return false;');
506+
button.addEventListener("click", function(e) {
507+
e.preventDefault();
508+
stageLines(originalCached);
509+
});
510+
copy_button.addEventListener("click", function(e) {
511+
e.preventDefault();
512+
copy();
513+
});
496514
} else {
497515
button.setAttribute("class","disabled");
498516
copy_button.setAttribute("class","disabled");

‎Resources/html/views/commit/index.html

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,7 @@
11
<html>
22
<head>
3+
<meta charset="utf-8">
4+
<meta http-equiv="Content-Security-Policy" content="default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self';">
35
<title>Diff for file</title>
46
<link rel="stylesheet" href="../../css/GitX.css" type="text/css" media="screen" title="no title" charset="utf-8">
57
<script src="../../lib/jquery-2.0.2.min.js" type="text/javascript" charset="utf-8"></script>
@@ -21,7 +23,7 @@ <h1 id='title'>
2123

2224
</h1>
2325

24-
<div id="notification" style="display:none">
26+
<div id="notification" class="hidden">
2527
<img src="../../images/spinner.gif" alt="Spinner" id="spinner"></img>
2628
<div id="notification_message"></div>
2729
</div>

‎Resources/html/views/commit/test.html

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@ <h1 id="title">
1818

1919
</h1>
2020

21-
<div id="notification" style="display:none">
21+
<div id="notification" class="hidden">
2222
<img src="../../images/spinner.gif" alt="Spinner" id="spinner">
2323
<div id="notification_message"></div>
2424
</div>
@@ -93,4 +93,4 @@ <h1 id="title">
9393
96
9494
</div><div class="lines"><div index="0" class="hunkheader"><a href="#" class="hunkbutton" onclick="discardHunk(this, event); return false">Discard</a><a href="#" class="hunkbutton" onclick="addHunk(this, false); return false">Stage</a>@@ -12,6 +12,8 @@</div><div index="1" class="noopline"> </div><div index="2" class="noopline"> @implementation PBWebChangesController</div><div index="3" class="noopline"> </div><div index="4" class="addline">+@synthesize fileViewerController;</div><div index="5" class="addline">+</div><div index="6" class="noopline"> - (void) awakeFromNib</div><div index="7" class="noopline"> {</div><div index="8" class="noopline"> selectedFile = nil;</div><div index="9" class="hunkheader"><a href="#" class="hunkbutton" onclick="discardHunk(this, event); return false">Discard</a><a href="#" class="hunkbutton" onclick="addHunk(this, false); return false">Stage</a>@@ -72,8 +74,11 @@ -(IBAction)displayControlChanged:(id)sender{</div><div index="10" class="noopline"> </div><div index="11" class="noopline"> - (void) refresh</div><div index="12" class="noopline"> {</div><div index="13" class="delline">- if (!finishedLoading)</div><div index="14" class="addline">+ [fileViewerController showFile:[selectedFile path] sha:nil];</div><div index="15" class="addline">+ /*if (!finishedLoading)</div><div index="16" class="noopline"> return;</div><div index="17" class="addline">+<span class="whitespace"> </span></div><div index="18" class="addline">+ [fileViewerController showFile:selectedFile sha:@""];</div><div index="19" class="noopline"> </div><div index="20" class="noopline"> id script = [view windowScriptObject];</div><div index="21" class="noopline"> </div><div index="22" class="hunkheader"><a href="#" class="hunkbutton" onclick="discardHunk(this, event); return false">Discard</a><a href="#" class="hunkbutton" onclick="addHunk(this, false); return false">Stage</a>@@ -85,7 +90,7 @@ - (void) refresh</div><div index="23" class="noopline"> [script callWebScriptMethod:@"showFileBlame"</div><div index="24" class="noopline"> withArguments:[NSArray arrayWithObjects:selectedFile ?: (id)[NSNull null],</div><div index="25" class="noopline"> [NSNumber numberWithBool:selectedFileIsCached], nil]];</div><div index="26" class="delline">- }</div><div index="27" class="addline">+ }*/</div><div index="28" class="noopline"> }</div><div index="29" class="noopline"> </div><div index="30" class="noopline"> - (void)stageHunk:(NSString *)hunk reverse:(BOOL)reverse</div></div></div></div></div>
9595

96-
</body></html>
96+
</body></html>

‎Resources/html/views/diff/diffWindow.js

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,11 @@
11
// for diffs shown in the PBDiffWindow
22

3+
var showDiff = function(diff) {
4+
highlightDiff(diff, $("diff"));
5+
};
6+
37
var setMessage = function(message) {
4-
$("message").style.display = "";
8+
$("message").classList.remove("hidden");
59
$("message").textContent = message;
610
$("diff").style.display = "none";
711
};

‎Resources/html/views/diff/index.html

Lines changed: 3 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,7 @@
11
<html>
22
<head>
3+
<meta charset="utf-8">
4+
<meta http-equiv="Content-Security-Policy" content="default-src 'none'; script-src 'self'; style-src 'self';">
35
<title>Details for commit</title>
46
<link rel="stylesheet" href="../../css/GitX.css" type="text/css" media="screen" title="no title" charset="utf-8">
57
<script src="../../lib/jquery-2.0.2.min.js" type="text/javascript" charset="utf-8"></script>
@@ -10,16 +12,10 @@
1012

1113
<link rel="stylesheet" href="diffWindow.css" type="text/css" media="screen" title="no title" charset="utf-8">
1214
<script src="diffWindow.js" type="text/javascript" charset="utf-8"></script>
13-
14-
<script type="text/javascript" charset="utf-8">
15-
var showDiff = function(diff) {
16-
highlightDiff(diff, $("diff"));
17-
}
18-
</script>
1915
</head>
2016

2117
<body>
22-
<div id="message" style="display:none">
18+
<div id="message" class="hidden">
2319
There are no differences
2420
</div>
2521
<div id='diff'></div>

‎Resources/html/views/fileview/index.html

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,8 @@
1+
<!DOCTYPE html>
12
<html>
23
<head>
4+
<meta charset="utf-8">
5+
<meta http-equiv="Content-Security-Policy" content="default-src 'none'; script-src 'self'; style-src 'self';">
36
<script src="../../lib/GitX.js" type="text/javascript" charset="utf-8"></script>
47
<script src="../../lib/syntaxhighlighter/scripts/shCore.js" type="text/javascript" charset="utf-8"></script>
58
<script src="../../lib/syntaxhighlighter/scripts/shAutoloader.js" type="text/javascript" charset="utf-8"></script>
@@ -38,4 +41,4 @@
3841
<body>
3942
<div id="source"></div>
4043
</body>
41-
</html>
44+
</html>

‎Resources/html/views/fileview/index_test.html

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,8 @@
1+
<!DOCTYPE html>
12
<html>
23
<head>
4+
<meta charset="utf-8">
5+
<meta http-equiv="Content-Security-Policy" content="default-src 'none'; script-src 'self'; style-src 'self';">
36
<script src="../../lib/GitX.js" type="text/javascript" charset="utf-8"></script>
47
<script src="../../lib/syntaxhighlighter/scripts/shCore.js" type="text/javascript" charset="utf-8"></script>
58
<script src="../../lib/syntaxhighlighter/scripts/shBrushObjC.js" type="text/javascript" charset="utf-8"></script>
@@ -45,4 +48,4 @@
4548

4649
</div>
4750
</body>
48-
</html>
51+
</html>

0 commit comments

Comments
 (0)