Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Fix search-on-click #4691

Merged
merged 4 commits into from
Feb 20, 2017
Merged

Fix search-on-click #4691

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
03efc57
Fix search-on-click
numrut Feb 15, 2017
9914307
Add URL encoding
numrut Feb 15, 2017
9d783dd
Update site_suggestions.js
numrut Feb 17, 2017
1ad7271
Update suggestions.js
numrut Feb 17, 2017
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 5 additions & 0 deletions static/js/impala/site_suggestions.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,6 +12,11 @@
// Update the 'Search add-ons for <b>"{addon}"</b>' text.
settings['$results'].find('p b').html(format('"{0}"',
settings.searchTerm));

// Update the .sel link.
var searchUrl = settings['$form'].attr('action') + '?q={0}';
settings['$results'].find('.sel').attr('href', format(searchUrl,
settings.urlSearchTerm));

var li_item = template(
'<li><a href="{url}"><span {cls} {icon}>{name}</span>{subtitle}</a></li>'
Expand Down
4 changes: 3 additions & 1 deletion static/js/impala/suggestions.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -130,12 +130,14 @@ $.fn.searchSuggestions = function($results, processCallback, searchType) {
$results.filter('.visible').removeClass('visible');
return;
}
var urlVal = encodeURIComponent($self.val());
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This will also need HTML escaping too.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

What is "HTML escaping"?)

Copy link
Contributor

@muffinresearch muffinresearch Feb 17, 2017 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If you don't escape the HTML in the form value this would result in an XSS vulnerability [1].

In this case you need to encode for a URL and also escape any HTML in the string so that HTML can't be potentially be injected.

To do that you just need to run escape_() on the URI-encode string. See also the previous comments and jsbin for an example.

[1] https://en.wikipedia.org/wiki/Cross-site_scripting

Copy link
Contributor Author

@numrut numrut Feb 17, 2017 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

That function escapes &, >, <, ' and ". But almost all of those symbols are already processed by encodeURIComponent. The only exception is '.

Query string must be percent-encoded [1]. And encodeURIComponent does it. escape_ makes another replace and breaks strings with ' in them. It adds ampersand, which is reserved symbol in query string.

[1] https://en.wikipedia.org/wiki/Percent-encoding

Copy link
Contributor

@muffinresearch muffinresearch Feb 17, 2017 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The ' doesn't cause a problem in the url and ends-up as %27 in the resulting href when inserted. Whilst it seems somewhat overkill I think escaping for the HTML context is still worth doing.

http://jsbin.com/huxadul/edit?js,console,output

Copy link
Contributor Author

@numrut numrut Feb 17, 2017 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The ' doesn't cause a problem in the url and ends-up as %27 in the resulting href when inserted

Seems, it happens on JS Bin only. Try escape_(encodeURIComponent("'foo'")) in browser's console.

If we really need to escape everything, str.replace(/[^]/g, escape) does the trick. But I think encodeURIComponent(str) or encodeURIComponent(str).replace(/'/g, '%27') is quite enough.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Seems, it happens on JS Bin only. Try escape_(encodeURIComponent("'foo'")) in browser's console.

It's not just the escaping and encoding you need to append the HTML into the DOM.

Copy link
Contributor

@muffinresearch muffinresearch Feb 20, 2017 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looking at this a bit more, it's using attr for the href so escaping is implicit. I'm not sure why I was thinking this was using html() but that's only used here: https://github.com/mozilla/addons-server/blob/master/static/js/impala/site_suggestions.js#L13 so this patch is fine as it is. Sorry for the noise!


// Required data to send to the callback.
var settings = {
'$results': $results,
'$form': $form,
'searchTerm': val
'searchTerm': val,
'urlSearchTerm': urlVal
};

// Optional data for callback.
Expand Down