Skip to content

Commit 88e7961

Browse files
arnayv-47github-advanced-security[bot]
arnayv-47
and
github-advanced-security[bot]
authored
Potential fix for code scanning alert no. 10: Incomplete multi-character sanitization (#193)
* Potential fix for code scanning alert no. 10: Incomplete multi-character sanitization Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> * Potential fix for code scanning alert no. 9: Incomplete multi-character sanitization Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> * Potential fix for code scanning alert no. 8: Incomplete multi-character sanitization Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> * Potential fix for code scanning alert no. 7: Incomplete multi-character sanitization Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> * Potential fix for code scanning alert no. 5: Incomplete multi-character sanitization Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> * Potential fix for code scanning alert no. 6: Incomplete multi-character sanitization Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> * Potential fix for code scanning alert no. 3: Incomplete multi-character sanitization Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> * Potential fix for code scanning alert no. 4: Incomplete multi-character sanitization Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> * Potential fix for code scanning alert no. 1: Incomplete multi-character sanitization Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> * Potential fix for code scanning alert no. 2: Incomplete multi-character sanitization Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> --------- Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
1 parent 27afa2e commit 88e7961

2 files changed

Lines changed: 86 additions & 30 deletions

File tree

‎_archive_reference/TT_TestPages/DataTables-1.10.18/js/jquery.dataTables.js‎

Lines changed: 47 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -1512,7 +1512,12 @@
15121512

15131513

15141514
var _stripHtml = function ( d ) {
1515-
return d.replace( _re_html, '' );
1515+
var previous;
1516+
do {
1517+
previous = d;
1518+
d = d.replace( _re_html, '' );
1519+
} while (d !== previous);
1520+
return d;
15161521
};
15171522

15181523

@@ -5804,7 +5809,11 @@
58045809

58055810
for ( var i=0, ien=settings.aoData.length ; i<ien ; i++ ) {
58065811
s = _fnGetCellData( settings, i, colIdx, 'display' )+'';
5807-
s = s.replace( __re_html_remove, '' );
5812+
let previous;
5813+
do {
5814+
previous = s;
5815+
s = s.replace( __re_html_remove, '' );
5816+
} while (s !== previous);
58085817
s = s.replace( /&nbsp;/g, ' ' );
58095818

58105819
if ( s.length > max ) {
@@ -6055,7 +6064,7 @@
60556064
{
60566065
var col = columns[i];
60576066
var asSorting = col.asSorting;
6058-
var sTitle = col.sTitle.replace( /<.*?>/g, "" );
6067+
var sTitle = _fnStripHtml(col.sTitle);
60596068
var th = col.nTh;
60606069

60616070
// IE7 is throwing an error when setting these properties with jQuery's
@@ -6084,6 +6093,16 @@
60846093
th.setAttribute('aria-label', label);
60856094
}
60866095
}
6096+
6097+
/**
6098+
* Safely removes HTML tags from a string using DOMParser.
6099+
* @param {string} html - The HTML string to sanitize.
6100+
* @returns {string} - The sanitized string with HTML tags removed.
6101+
*/
6102+
function _fnStripHtml(html) {
6103+
var doc = new DOMParser().parseFromString(html, 'text/html');
6104+
return doc.body.textContent || "";
6105+
}
60876106

60886107

60896108
/**
@@ -14694,13 +14713,19 @@
1469414713

1469514714
$.extend( DataTable.ext.type.search, {
1469614715
html: function ( data ) {
14697-
return _empty(data) ?
14698-
data :
14699-
typeof data === 'string' ?
14700-
data
14701-
.replace( _re_new_lines, " " )
14702-
.replace( _re_html, "" ) :
14703-
'';
14716+
if (_empty(data)) {
14717+
return data;
14718+
}
14719+
if (typeof data === 'string') {
14720+
data = data.replace(_re_new_lines, " ");
14721+
let previous;
14722+
do {
14723+
previous = data;
14724+
data = data.replace(_re_html, "");
14725+
} while (data !== previous);
14726+
return data;
14727+
}
14728+
return '';
1470414729
},
1470514730

1470614731
string: function ( data ) {
@@ -14789,11 +14814,18 @@
1478914814

1479014815
// html
1479114816
"html-pre": function ( a ) {
14792-
return _empty(a) ?
14793-
'' :
14794-
a.replace ?
14795-
a.replace( /<.*?>/g, "" ).toLowerCase() :
14796-
a+'';
14817+
if (_empty(a)) {
14818+
return '';
14819+
}
14820+
if (a.replace) {
14821+
let previous;
14822+
do {
14823+
previous = a;
14824+
a = a.replace(/<.*?>/g, "");
14825+
} while (a !== previous);
14826+
return a.toLowerCase();
14827+
}
14828+
return a + '';
1479714829
},
1479814830

1479914831
// string

‎_archive_reference/TT_TestPages/datatables.js‎

Lines changed: 39 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -1524,7 +1524,12 @@
15241524

15251525

15261526
var _stripHtml = function ( d ) {
1527-
return d.replace( _re_html, '' );
1527+
var previous;
1528+
do {
1529+
previous = d;
1530+
d = d.replace( _re_html, '' );
1531+
} while (d !== previous);
1532+
return d;
15281533
};
15291534

15301535

@@ -5816,7 +5821,10 @@
58165821

58175822
for ( var i=0, ien=settings.aoData.length ; i<ien ; i++ ) {
58185823
s = _fnGetCellData( settings, i, colIdx, 'display' )+'';
5819-
s = s.replace( __re_html_remove, '' );
5824+
do {
5825+
var previous = s;
5826+
s = s.replace( __re_html_remove, '' );
5827+
} while (s !== previous);
58205828
s = s.replace( /&nbsp;/g, ' ' );
58215829

58225830
if ( s.length > max ) {
@@ -6067,7 +6075,11 @@
60676075
{
60686076
var col = columns[i];
60696077
var asSorting = col.asSorting;
6070-
var sTitle = col.sTitle.replace( /<.*?>/g, "" );
6078+
var sTitle = col.sTitle;
6079+
do {
6080+
var previous = sTitle;
6081+
sTitle = sTitle.replace(/<.*?>/g, "");
6082+
} while (sTitle !== previous);
60716083
var th = col.nTh;
60726084

60736085
// IE7 is throwing an error when setting these properties with jQuery's
@@ -14706,13 +14718,18 @@
1470614718

1470714719
$.extend( DataTable.ext.type.search, {
1470814720
html: function ( data ) {
14709-
return _empty(data) ?
14710-
data :
14711-
typeof data === 'string' ?
14712-
data
14713-
.replace( _re_new_lines, " " )
14714-
.replace( _re_html, "" ) :
14715-
'';
14721+
if (_empty(data)) {
14722+
return data;
14723+
}
14724+
if (typeof data === 'string') {
14725+
data = data.replace(_re_new_lines, " ");
14726+
let previous;
14727+
do {
14728+
previous = data;
14729+
data = data.replace(_re_html, "");
14730+
} while (data !== previous);
14731+
}
14732+
return data;
1471614733
},
1471714734

1471814735
string: function ( data ) {
@@ -14801,11 +14818,18 @@
1480114818

1480214819
// html
1480314820
"html-pre": function ( a ) {
14804-
return _empty(a) ?
14805-
'' :
14806-
a.replace ?
14807-
a.replace( /<.*?>/g, "" ).toLowerCase() :
14808-
a+'';
14821+
if (_empty(a)) {
14822+
return '';
14823+
}
14824+
if (a.replace) {
14825+
let previous;
14826+
do {
14827+
previous = a;
14828+
a = a.replace(/<.*?>/g, "");
14829+
} while (a !== previous);
14830+
return a.toLowerCase();
14831+
}
14832+
return a + '';
1480914833
},
1481014834

1481114835
// string

0 commit comments

Comments
 (0)