[webui] Refactor packages_table partial

Cherry picked from master d9ebbfd
openSUSE · Oct 30, 2015 · c7f837a · c7f837a
1 parent 688dd77
commit c7f837a
Show file tree

Hide file tree

Showing 3 changed files with 17 additions and 3 deletions.
diff --git a/src/api/app/helpers/webui/webui_helper.rb b/src/api/app/helpers/webui/webui_helper.rb
@@ -549,4 +549,12 @@ def escape_nested_list(list)
       "']".html_safe
     }.join(",\n").html_safe
   end
+
+  def escape_list(list)
+    list.map { |p|
+      "['".html_safe +
+      escape_javascript(p) +
+      "']".html_safe
+    }.join(',').html_safe
+  end
 end
diff --git a/src/api/app/views/webui/project/_packages_table.html.erb b/src/api/app/views/webui/project/_packages_table.html.erb
@@ -24,7 +24,7 @@
           <% cache [packageurl, array_cachekey(@packages)] do %>
               <div id="packages_table_wrapper" data-url="<%= packageurl %>">
                 <%= javascript_tag do %>
-                    var packages = [ <%= @packages.map { |p| "['#{p}']" }.join(',').html_safe %> ];
+                    var packages = [ <%= escape_list(@packages) %> ];
                     renderPackagesTable("packages_table_wrapper", packages);
                 <% end %>
               </div>
@@ -53,8 +53,8 @@
           <% cache [packageurl, array_cachekey(@ipackages)] do %>
               <div id="ipackages_wrapper" data-url="<%= packageurl %>">
                 <%= javascript_tag do %>
-                    var ipackages = [ <%= @ipackages.map { |p| "#{p}" }.join(',').html_safe %>
-                    ]; renderPackagesProjectsTable({packages: ipackages, length: '25', name: 'ipackages_wrapper'});
+                    var ipackages = [ <%= escape_nested_list(@ipackages) %> ];
+                    renderPackagesProjectsTable({packages: ipackages, name: 'ipackages_wrapper'});
                 <% end %>
               </div>
           <% end %>

diff --git a/src/api/test/unit/webui/webui_helper_test.rb b/src/api/test/unit/webui/webui_helper_test.rb
@@ -9,6 +9,12 @@ def test_escape_project_list_escaped_forbidden_chars
     assert escape_nested_list(input), output
   end
 
+  def test_escape_list_escapes_forbidden_chars
+    input = ['<p>home:Iggy</p>', '<p>This is a paragraph</p>']
+    output = "['&lt;p&gt;home:Iggy&lt;\\/p&gt;'],['&lt;p&gt;This is a paragraph&lt;\\/p&gt;']"
+    assert_equal escape_list(input), output
+  end
+
   def test_format_projectname
     assert_equal "some:project:foo:bar", format_projectname("some:project:foo:bar", "bob")
     assert_equal "~", format_projectname("home:bob", "bob")