filter unwanted elements when receiving patches

9 years ago · 7e8d66a141
parent 648f64c6fc
commit 7e8d66a141
2 changed files with 35 additions and 26 deletions
--- a/www/pad/index.html
+++ b/www/pad/index.html
@ -48,32 +48,6 @@
 </head>
 <body>
    <iframe id="pad-iframe" src="inner.html"></iframe>
    <div id="debug"><button>DEBUG</button></div>
    <textarea id="feedback"></textarea>
    <script>
      require(['/bower_components/jquery/dist/jquery.min.js'], function() {
        var $ = window.$;
        $('#debug').on('click', function() {
          if($('#feedback').is(':visible')) {
            $('#pad-iframe').css({
              'width' : '100%'
            });
            $('#debug').css({
              'right' : '0%'
            });
          }
          else {
            $('#pad-iframe').css({
              'width' : '70%'
            });
            $('#debug').css({
              'right' : '30%'
            });
          }
          $('#feedback').toggle();
        });
      });
    </script>
 </body>
 </html>
--- a/www/pad/main.js
+++ b/www/pad/main.js
@ -100,8 +100,43 @@ define([
            // don't let the user edit until the pad is ready
            setEditable(false);
            var forbiddenTags = [
                'SCRIPT',
                'IFRAME',
                'OBJECT',
                'APPLET',
                'VIDEO',
                'AUDIO'
            ];
            var diffOptions = {
                preDiffApply: function (info) {
                    /*
                        Don't accept attributes that begin with 'on'
                        these are probably listeners, and we don't want to
                        send scripts over the wire.
                    */
                    if (['addAttribute', 'modifyAttribute'].indexOf(info.diff.action) !== -1) {
                        if (/^on/.test(info.diff.name)) {
                            console.log("Rejecting forbidden element attribute with name (%s)", info.diff.name);
                            return true;
                        }
                    }
                    /*
                        Also reject any elements which would insert any one of
                        our forbidden tag types: script, iframe, object,
                            applet, video, or audio
                    */
                    if (['addElement', 'replaceElement'].indexOf(info.diff.action) !== -1) {
                        if (info.diff.element && forbiddenTags.indexOf(info.diff.element.nodeName) !== -1) {
                            console.log("Rejecting forbidden tag of type (%s)", info.diff.element.nodeName);
                            return true;
                        } else if (info.diff.newValue && forbiddenTags.indexOf(info.diff.newValue.nodeType) !== -1) {
                            console.log("Rejecting forbidden tag of type (%s)", info.diff.newValue.nodeName);
                            return true;
                        }
                    }
                    if (info.node && info.node.tagName === 'BODY') {
                        if (info.diff.action === 'removeAttribute' &&
                            ['class', 'spellcheck'].indexOf(info.diff.name) !== -1) {