11import $ from 'jquery' ;
22import renderjson from 'renderjson' ;
33import CodeMirror from './codeMirrorLoader' ;
4+ import escapeHtml from './escapeHtml' ;
45
56function getParameterByName ( name ) {
67 name = name . replace ( / \[ / , '\\[' ) . replace ( / [ \] ] / , '\\]' ) ;
@@ -137,7 +138,7 @@ $(() => {
137138 // Set the element with spinner for now
138139 target . html ( spinner ) ;
139140
140- $ . get ( ` ${ makeCollectionUrl ( ) } ${ encodeURIComponent ( _id ) } / ${ prop } ` , function ( input ) {
141+ function renderProp ( input ) {
141142 // Images inline
142143 if (
143144 typeof input === 'string'
@@ -148,7 +149,7 @@ $(() => {
148149 || input . substr ( 0 , 23 ) === 'data:image/jpeg;base64,'
149150 )
150151 ) {
151- input = ' <img src="' + input + ' " style="max-height:100%; max-width:100%; "/>' ;
152+ return ` <img src="${ escapeHtml ( input ) } " style="max-height:100%; max-width:100%; "/>` ;
152153 }
153154
154155 // Audio inline
@@ -160,7 +161,7 @@ $(() => {
160161 || input . substr ( 0 , 22 ) === 'data:audio/mp3;base64,'
161162 )
162163 ) {
163- input = ' <audio controls style="width:45px;" src="' + input + ' ">Your browser does not support the audio element.</audio>' ;
164+ return ` <audio controls style="width:45px;" src="${ escapeHtml ( input ) } ">Your browser does not support the audio element.</audio>` ;
164165 }
165166
166167 // Video inline
@@ -172,16 +173,22 @@ $(() => {
172173 || input . substr ( 0 , 22 ) === 'data:video/ogv;base64,'
173174 )
174175 ) {
175- input = '<video controls><source type="' + input . substring ( input . indexOf ( ':' ) + 1 , input . indexOf ( ';' ) ) + '" src="' + input + '"/>'
176- + 'Your browser does not support the video element.</video>' ;
176+ const videoFormat = input . match ( / ^ d a t a : ( .* ) ; b a s e 6 4 / ) [ 1 ] ;
177+ return `<video controls><source type="${ escapeHtml ( videoFormat ) } " src="${ escapeHtml ( input ) } "/>
178+ + 'Your browser does not support the video element.</video>` ;
177179 }
178-
179180 if ( typeof input === 'object' && ( input . toString ( ) === '[object Object]' || input . toString ( ) . substr ( 0 , 7 ) === '[object' ) ) {
180- input = renderjson ( input ) ;
181+ return renderjson ( input ) ;
181182 }
182183
184+ // treat unknown data as escaped string
185+ return escapeHtml ( input . toString ( ) ) ;
186+ }
187+
188+ $ . get ( `${ makeCollectionUrl ( ) } ${ encodeURIComponent ( _id ) } /${ prop } ` , function ( prop ) {
189+ prop = renderProp ( prop ) ;
183190 // Set the element with gotten datas
184- target . parent ( ) . html ( input ) ;
191+ target . parent ( ) . html ( prop ) ;
185192
186193 // Set original scroll position
187194 $ ( '.tableWrapper' ) . scrollLeft ( leftScroll ) ;
0 commit comments