Skip to content

Remove HTML entity decoding from convertToSVG #804

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 3 commits into from
Aug 2, 2016
Merged

Remove HTML entity decoding from convertToSVG #804

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
6a66569
Remove html entity decoding from convertToSVG
scjody Aug 1, 2016
6cf80de
Update code & mocks to not depend on entity decode
scjody Aug 2, 2016
7649e5d
Update tests to not depend on entity decode
scjody Aug 2, 2016
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 1 addition & 2 deletions src/lib/svg_text_utils.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -252,8 +252,7 @@ function encodeForHTML(_str) {
}

function convertToSVG(_str) {
var htmlEntitiesDecoded = Plotly.util.html_entity_decode(_str);
var result = htmlEntitiesDecoded
var result = _str
.split(/(<[^<>]*>)/).map(function(d) {
var match = d.match(/<(\/?)([^ >]*)\s*(.*)>/i),
tag = match && match[2].toLowerCase(),
Expand Down
5 changes: 3 additions & 2 deletions src/plots/cartesian/axes.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1053,7 +1053,8 @@ function formatLinear(ax, out, hover, extraPrecision, hideexp) {
// new, more reliable procedure than d3.round or similar:
// add half the rounding increment, then stringify and truncate
// also automatically switch to sci. notation
var SIPREFIXES = ['f', 'p', 'n', '&mu;', 'm', '', 'k', 'M', 'G', 'T'];
var SIPREFIXES = ['f', 'p', 'n', 'μ', 'm', '', 'k', 'M', 'G', 'T'];

function numFormat(v, ax, fmtoverride, hover) {
// negative?
var isNeg = v < 0,
Expand Down Expand Up @@ -1144,7 +1145,7 @@ function numFormat(v, ax, fmtoverride, hover) {
v += 'E' + signedExponent;
}
else if(exponentFormat === 'power') {
v += '&times;10<sup>' + signedExponent + '</sup>';
v += '×10<sup>' + signedExponent + '</sup>';
}
else if(exponentFormat === 'B' && exponent === 9) {
v += 'B';
Expand Down
4 changes: 2 additions & 2 deletions src/plots/cartesian/graph_interact.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -695,7 +695,7 @@ function cleanPoint(d, hovermode) {
d.xLabel += ' +' + xeText + ' / -' +
Axes.tickText(d.xa, d.xa.c2l(d.xerrneg), 'hover').text;
}
else d.xLabel += ' &plusmn; ' + xeText;
else d.xLabel += ' ± ' + xeText;

// small distance penalty for error bars, so that if there are
// traces with errors and some without, the error bar label will
Expand All @@ -708,7 +708,7 @@ function cleanPoint(d, hovermode) {
d.yLabel += ' +' + yeText + ' / -' +
Axes.tickText(d.ya, d.ya.c2l(d.yerrneg), 'hover').text;
}
else d.yLabel += ' &plusmn; ' + yeText;
else d.yLabel += ' ± ' + yeText;

if(hovermode === 'y') d.distance += 1;
}
Expand Down
4 changes: 2 additions & 2 deletions test/image/mocks/axes_enumerated_ticks.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,7 +33,7 @@
"xaxis": {
"ticktext": [
"<span style=\"fill:green\">green</span> eggs",
"&amp; ham",
"& ham",
"H<sub>2</sub>O",
"Gorgonzola"
],
Expand All @@ -47,4 +47,4 @@
]
}
}
}
}
43 changes: 22 additions & 21 deletions test/jasmine/tests/svg_text_utils_test.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -121,33 +121,34 @@ describe('svg+text utils', function() {
});

it('wrap XSS attacks in href', function() {
var textCases = [
'<a href="XSS\" onmouseover=&quot;alert(1)\" style=&quot;font-size:300px">Subtitle</a>',
'<a href="XSS&quot; onmouseover=&quot;alert(1)&quot; style=&quot;font-size:300px">Subtitle</a>'
];
var node = mockTextSVGElement(
'<a href="XSS" onmouseover="alert(1)" style="font-size:300px">Subtitle</a>'
);

textCases.forEach(function(textCase) {
var node = mockTextSVGElement(textCase);
expect(node.text()).toEqual('Subtitle');
assertAnchorAttrs(node);
assertAnchorLink(node, 'XSS onmouseover=alert(1) style=font-size:300px');
});

expect(node.text()).toEqual('Subtitle');
assertAnchorAttrs(node);
assertAnchorLink(node, 'XSS onmouseover=alert(1) style=font-size:300px');
});
it('wrap XSS attacks with quoted entities in href', function() {
var node = mockTextSVGElement(
'<a href="XSS&quot; onmouseover=&quot;alert(1)&quot; style=&quot;font-size:300px">Subtitle</a>'
);

console.log(node.select('a').attr('xlink:href'));
expect(node.text()).toEqual('Subtitle');
assertAnchorAttrs(node);
assertAnchorLink(node, 'XSS&quot; onmouseover=&quot;alert(1)&quot; style=&quot;font-size:300px');
});

it('should keep query parameters in href', function() {
var textCases = [
'<a href="https://abc.com/myFeature.jsp?name=abc&pwd=def">abc.com?shared-key</a>',
'<a href="https://abc.com/myFeature.jsp?name=abc&amp;pwd=def">abc.com?shared-key</a>'
];

textCases.forEach(function(textCase) {
var node = mockTextSVGElement(textCase);
var node = mockTextSVGElement(
'<a href="https://abc.com/myFeature.jsp?name=abc&pwd=def">abc.com?shared-key</a>'
);

assertAnchorAttrs(node);
expect(node.text()).toEqual('abc.com?shared-key');
assertAnchorLink(node, 'https://abc.com/myFeature.jsp?name=abc&pwd=def');
});
assertAnchorAttrs(node);
expect(node.text()).toEqual('abc.com?shared-key');
assertAnchorLink(node, 'https://abc.com/myFeature.jsp?name=abc&pwd=def');
});

it('allow basic spans', function() {
Expand Down