Merge pull request #18 from Worklytics/s174-code-scanning-alerts

S174 code scanning alerts
Worklytics · May 22, 2024 · 9110cc8 · 9110cc8
2 parents cf960f2 + 4cc2d08
commit 9110cc8
Show file tree

Hide file tree

Showing 5 changed files with 35 additions and 3 deletions.
diff --git a/java/src/main/resources/ui/lodash.4.17.15.js b/java/src/main/resources/ui/lodash.4.17.15.js
diff --git a/java/src/main/resources/ui/root_list.html b/java/src/main/resources/ui/root_list.html
@@ -11,6 +11,7 @@
   <script type="text/javascript" src="jquery.timeago.js"></script>
   <script type="text/javascript" src="jquery.ba-hashchange.min.js"></script>
   <script type="text/javascript" src="jquery.json.min.js"></script>
+  <script type="text/javascript" src="lodash.4.17.15.js"></script>
   <script type="text/javascript" src="common.js"></script>
   <script type="text/javascript" src="list.js"></script>
   <script type="text/javascript">

diff --git a/java/src/main/resources/ui/root_list.js b/java/src/main/resources/ui/root_list.js
@@ -21,9 +21,10 @@
 
 function initRootList() {
   setButter('Loading root jobs...');
+  var query = new URLSearchParams(location.search);
   $.ajax({
     type: 'GET',
-    url: 'rpc/list' + window.location.search,
+    url: 'rpc/list' + '?' + _.escape(query.toString()),
     dataType: 'text',
     error: function(request, textStatus) {
       getResponseDataJson(textStatus);

diff --git a/java/src/main/resources/ui/status.html b/java/src/main/resources/ui/status.html
@@ -11,6 +11,7 @@
   <script type="text/javascript" src="jquery.timeago.js"></script>
   <script type="text/javascript" src="jquery.ba-hashchange.min.js"></script>
   <script type="text/javascript" src="jquery.json.min.js"></script>
+  <script type="text/javascript" src="lodash.4.17.15.js"></script>
   <script type="text/javascript" src="common.js"></script>
   <script type="text/javascript" src="status.js"></script>
   <script type="text/javascript">

diff --git a/java/src/main/resources/ui/status.js b/java/src/main/resources/ui/status.js
@@ -666,7 +666,7 @@ function findActivePipeline(pipelineId, isRoot) {
 
 function getSelectedPipelineId() {
   var prefix = '#pipeline-';
-  var pieces = location.hash.split(';', 2);
+  var pieces = _.escape(location.hash).split(';', 2);
   if (pieces[0].indexOf(prefix) == 0) {
     return pieces[0].substr(prefix.length);
   }
@@ -677,7 +677,7 @@ function getSelectedPipelineId() {
 /* Event handlers */
 function handleHashChange() {
   var prefix = '#pipeline-';
-  var hash = location.hash;
+  var hash = _.escape(location.hash);
   var pieces = hash.split(';', 2);
   var pipelineId = null;