Skip to content

Commit

Permalink
fix(core): use textContent instead of innerHTML
Browse files Browse the repository at this point in the history
  • Loading branch information
Johann-S committed Feb 3, 2020
1 parent 90b9311 commit d78897b
Show file tree
Hide file tree
Showing 3 changed files with 21 additions and 2 deletions.
2 changes: 1 addition & 1 deletion src/eventHandlers.js
Original file line number Diff line number Diff line change
Expand Up @@ -29,7 +29,7 @@ function handleInputChange() {
const inputValue = getSelectedFiles(this)

if (inputValue.length) {
element.innerHTML = inputValue
element.textContent = inputValue
} else {
restoreDefaultText(this)
}
Expand Down
3 changes: 2 additions & 1 deletion src/util.js
Original file line number Diff line number Diff line change
Expand Up @@ -34,7 +34,8 @@ const restoreDefaultText = (input) => {

if (label) {
const element = findFirstChildNode(label)
element.innerHTML = defaultText

element.textContent = defaultText
}
}

Expand Down
18 changes: 18 additions & 0 deletions tests/units/eventHandlers.spec.js
Original file line number Diff line number Diff line change
Expand Up @@ -40,6 +40,24 @@ describe('eventHandlers.js', function () {
input.dispatchEvent(new Event('change'))
})

it('should change the label when a file is selected and escape html', function (done) {
bsCustomFileInput.init()

var label = document.querySelector('.custom-file-label')
var expectedValue = '<svg onload=alert(1)>'

input.addEventListener('change', function () {
expect(label.innerHTML).equal(expectedValue)
done()
})

Object.defineProperty(input, 'value', {
value: '<svg onload=alert(1)>',
})

input.dispatchEvent(new Event('change'))
})

it('should remove fakepath if found', function (done) {
bsCustomFileInput.init()

Expand Down

0 comments on commit d78897b

Please sign in to comment.