XSS fix (layers name)

viliusle · Dec 1, 2023 · f22cb46 · f22cb46 · viliusle · Dec 1, 2023
1 parent 1fce319
commit f22cb46
Show file tree

Hide file tree

Showing 2 changed files with 8 additions and 2 deletions.
diff --git a/src/js/core/gui/gui-layers.js b/src/js/core/gui/gui-layers.js
@@ -163,8 +163,10 @@ class GUI_layers_class {
  if(value.composition === 'source-atop'){
  html += ' <button class="arrow_down" data-id="' + value.id + '" ></button>';
  }
+
+ var layer_title = this.Helper.escapeHtml(value.name);
 
- html += ' <button class="layer_name" id="layer_name" data-id="' + value.id + '">' + value.name + '</button>';
+ html += ' <button class="layer_name" id="layer_name" data-id="' + value.id + '">' + layer_title + '</button>';
  html += ' <div class="clear"></div>';
  html += '</div>';
 

diff --git a/src/js/modules/layer/rename.js b/src/js/modules/layer/rename.js
@@ -2,21 +2,25 @@ import app from './../../app.js';
 import config from './../../config.js';
 import Base_layers_class from './../../core/base-layers.js';
 import Dialog_class from './../../libs/popup.js';
+import Helper_class from './../../libs/helpers.js';
 
 class Layer_rename_class {
 
  constructor() {
  this.Base_layers = new Base_layers_class();
  this.POP = new Dialog_class();
+ this.Helper = new Helper_class();
  }
 
  rename(id = null) {
  var _this = this;
 
+ var name_ = this.Helper.escapeHtml(config.layer.name);
+
  var settings = {
  title: 'Rename',
  params: [
- {name: "name", title: "Name:", value: config.layer.name},
+ {name: "name", title: "Name:", value: name_},
  ],
  on_load: function () {
  document.querySelector('#pop_data_name').select();