Skip to content
This repository was archived by the owner on Dec 19, 2023. It is now read-only.

Mismatched .innerHTML and .innerText #1

Open
MegaLoler wants to merge 2 commits into
base: master
Choose a base branch
from
Open

Mismatched .innerHTML and .innerText #1

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
2e3ae08
innerHTML was being set to innerText, allowing escaped html to be une…
negativefnnancy Dec 23, 2020
ab9e3bc
change use of innerText to innerHTML in demo/index.html to prevent XSS
MegaLoler Jan 25, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
36 changes: 18 additions & 18 deletions demo/index.html
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -68,11 +68,11 @@ <h3 id="bands-head">Rank the bands</h3>
const dragonDrop = new DragonDrop(demo1, {
handle: '.handle',
announcement: {
grabbed: el => `${el.querySelector('span').innerText} grabbed`,
dropped: el => `${el.querySelector('span').innerText} dropped`,
grabbed: el => `${el.querySelector('span').innerHTML} grabbed`,
dropped: el => `${el.querySelector('span').innerHTML} dropped`,
reorder: (el, items) => {
const pos = items.indexOf(el) + 1;
const text = el.querySelector('span').innerText;
const text = el.querySelector('span').innerHTML;
return `The rankings have been updated, ${text} is now ranked #${pos} out of ${items.length}`;
},
cancel: 'Reranking cancelled.'
Expand All @@ -99,11 +99,11 @@ <h3 id="schedule-head">Today's schedule</h3>
new DragonDrop(demo2, {
handle: false,
announcement: {
grabbed: el => `${el.querySelector('div').innerText} grabbed`,
dropped: el => `${el.querySelector('div').innerText} dropped`,
grabbed: el => `${el.querySelector('div').innerHTML} grabbed`,
dropped: el => `${el.querySelector('div').innerHTML} dropped`,
reorder: (el, items) => {
const pos = items.indexOf(el) + 1;
const text = el.querySelector('div').innerText;
const text = el.querySelector('div').innerHTML;
return `The schedule has changed, ${text} is now item ${pos} of ${items.length}`;
},
cancel: 'Reschedule cancelled.'
Expand Down Expand Up @@ -152,11 +152,11 @@ <h3 id="nested">Nested lists</h3>
nested: true,
item: ':scope > li',
announcement: {
grabbed: function (el) { return el.querySelector('span').innerText + ' grabbed'; },
dropped: function (el) { return el.querySelector('span').innerText + ' dropped'; },
grabbed: function (el) { return el.querySelector('span').innerHTML + ' grabbed'; },
dropped: function (el) { return el.querySelector('span').innerHTML + ' dropped'; },
reorder: function (el, items) {
var pos = items.indexOf(el) + 1;
var text = el.querySelector('span').innerText;
var text = el.querySelector('span').innerHTML;
return 'The order has changed, ' + text + ' is now item ' + pos + ' of ' + items.length;
},
cancel: function () { return 'Reorder cancelled.'; }
Expand All @@ -182,11 +182,11 @@ <h3 id="nested">Nested lists</h3>
var demo1 = new DragonDrop(document.getElementById('demo-1'), {
handle: '.handle',
announcement: {
grabbed: function (el) { return el.querySelector('span').innerText + ' grabbed'; },
dropped: function (el) { return el.querySelector('span').innerText + ' dropped'; },
grabbed: function (el) { return el.querySelector('span').innerHTML + ' grabbed'; },
dropped: function (el) { return el.querySelector('span').innerHTML + ' dropped'; },
reorder: function (el, items) {
var pos = items.indexOf(el) + 1;
var text = el.querySelector('span').innerText;
var text = el.querySelector('span').innerHTML;
return 'The rankings have been updated, ' + text + ' is now ranked #' + pos + ' of ' + items.length;
},
cancel: function() { return 'Reranking cancelled.'; }
Expand Down Expand Up @@ -214,11 +214,11 @@ <h3 id="nested">Nested lists</h3>
var demo2 = new DragonDrop(document.getElementById('demo-2'), {
handle: false,
announcement: {
grabbed: function (el) { return el.querySelector('div').innerText + ' grabbed' },
dropped: function (el) { return el.querySelector('div').innerText + ' dropped' },
grabbed: function (el) { return el.querySelector('div').innerHTML + ' grabbed' },
dropped: function (el) { return el.querySelector('div').innerHTML + ' dropped' },
reorder: function (el, items) {
var pos = items.indexOf(el) + 1;
var text = el.querySelector('div').innerText;
var text = el.querySelector('div').innerHTML;
return 'The schedule has changed, ' + text + ' is now item ' + pos + ' of ' + items.length;
},
cancel: function () { return 'Reschedule cancelled.'; }
Expand All @@ -233,11 +233,11 @@ <h3 id="nested">Nested lists</h3>
nested: true,
item: ':scope > li',
announcement: {
grabbed: function (el) { return el.querySelector('span').innerText + ' grabbed'; },
dropped: function (el) { return el.querySelector('span').innerText + ' dropped'; },
grabbed: function (el) { return el.querySelector('span').innerHTML + ' grabbed'; },
dropped: function (el) { return el.querySelector('span').innerHTML + ' dropped'; },
reorder: function (el, items) {
var pos = items.indexOf(el) + 1;
var text = el.querySelector('span').innerText;
var text = el.querySelector('span').innerHTML;
return 'The order has changed, ' + text + ' is now item ' + pos + ' of ' + items.length;
},
cancel: function () { return 'Reorder cancelled.'; }
Expand Down
6 changes: 3 additions & 3 deletions dist/dragon-drop.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -456,14 +456,14 @@ var defaults = {
nested: false, // if true, stops propagation on keydown / click events
announcement: {
grabbed: function grabbed(el) {
return 'Item ' + el.innerText + ' grabbed';
return 'Item ' + el.innerHTML + ' grabbed';
},
dropped: function dropped(el) {
return 'Item ' + el.innerText + ' dropped';
return 'Item ' + el.innerHTML + ' dropped';
},
reorder: function reorder(el, items) {
var pos = items.indexOf(el) + 1;
var text = el.innerText;
var text = el.innerHTML;
return 'The list has been reordered, ' + text + ' is now item ' + pos + ' of ' + items.length;
},
cancel: 'Reordering cancelled'
Expand Down
2 changes: 1 addition & 1 deletion dist/dragon-drop.min.js
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

6 changes: 3 additions & 3 deletions lib/defaults.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,11 +5,11 @@ const defaults = {
inactiveClass: 'dragon-inactive', // added to other items when item is being dragged
nested: false, // if true, stops propagation on keydown / click events
announcement: {
grabbed: el => `Item ${el.innerText} grabbed`,
dropped: el => `Item ${el.innerText} dropped`,
grabbed: el => `Item ${el.innerHTML} grabbed`,
dropped: el => `Item ${el.innerHTML} dropped`,
reorder: (el, items) => {
const pos = items.indexOf(el) + 1;
const text = el.innerText;
const text = el.innerHTML;
return `The list has been reordered, ${text} is now item ${pos} of ${items.length}`;
},
cancel: 'Reordering cancelled'
Expand Down
4 changes: 3 additions & 1 deletion package-lock.json
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.