Skip to content

fix: escape wallet table values #5

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
1507819106zxzx-crypto wants to merge 1 commit into
base: master
Choose a base branch
from
Open

fix: escape wallet table values #5

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 7 additions & 5 deletions src/my-addresses/my-addresses.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -38,15 +38,17 @@ document.addEventListener('DOMContentLoaded', () => {
$.extend({}, dataTableParams, {
columns: [
{ data: 'id' },
{ data: 'address', render: (data) => { return `<input type="text" class="form-control-plaintext form-control-sm offset-lg-3 col-lg-6 font-weight-bold address" value="${data}" readonly="">`; }, width: '42%', class: 'text-center desktop' },
{ data: 'address', render: (data) => { return `<input type="text" class="form-control-plaintext form-control-sm offset-lg-3 col-lg-6 font-weight-bold address" value="${escapeHtml(data)}" readonly="">`; }, width: '42%', class: 'text-center desktop' },
{ data: 'balance', render: (data) => { return humanAmountFormat(data); }, class: 'text-center' },
{ data: 'input_count', class: 'text-center desktop' },
{ data: 'address', render: (data) => {
let btns = '';
btns += `<a class="btn btn-danger btn-sm mr-1" href="#send/${data}"><i class="icon icon-compass visible-sr"></i><span class="hidden-sr">Send</span></a>`;
btns += `<button class="btn btn-info btn-sm mr-1 qr-code-btn" data-address="${data}"><i class="icon icon-download visible-sr"></i><span class="hidden-sr">Receive</span></button>`;
btns += `<a class="btn btn-warning btn-sm mr-1" target="_blank" href="https://bgl.bitaps.com/${data}"><i class="icon icon-svg visible-sr"></i><span class="hidden-sr">Explorer</span></a>`;
btns += `<a class="btn btn-success btn-sm mr-1" href="#transactions/${data}"><i class="icon icon-insert-template visible-sr"></i><span class="hidden-sr">Transactions</span></a>`;
const encodedAddress = encodeURIComponent(data);
const safeAddress = escapeHtml(data);
btns += `<a class="btn btn-danger btn-sm mr-1" href="#send/${encodedAddress}"><i class="icon icon-compass visible-sr"></i><span class="hidden-sr">Send</span></a>`;
btns += `<button class="btn btn-info btn-sm mr-1 qr-code-btn" data-address="${safeAddress}"><i class="icon icon-download visible-sr"></i><span class="hidden-sr">Receive</span></button>`;
btns += `<a class="btn btn-warning btn-sm mr-1" target="_blank" href="https://bgl.bitaps.com/${encodedAddress}"><i class="icon icon-svg visible-sr"></i><span class="hidden-sr">Explorer</span></a>`;
btns += `<a class="btn btn-success btn-sm mr-1" href="#transactions/${encodedAddress}"><i class="icon icon-insert-template visible-sr"></i><span class="hidden-sr">Transactions</span></a>`;
return btns;
}, class: 'text-right' },
],
Expand Down
6 changes: 3 additions & 3 deletions src/transactions/transactions.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@ document.addEventListener('DOMContentLoaded', () => {
columns: [
{ data: 'id', className: 'dtr-control', render: (row, display, column) => {
let $html = '<div class="d-flex align-items-baseline">';
$html += `<div class="flex-fill">${column.id}</div>`;
$html += `<div class="flex-fill">${escapeHtml(column.id)}</div>`;
if (column.confirmations === '-') $html += `
<div class="flex-fill">
<div class="spinner-border spinner-border-sm" role="status">
Expand All @@ -21,7 +21,7 @@ document.addEventListener('DOMContentLoaded', () => {
return $html;
} },
{ data: 'timestamp', render: dateTimeFormat },
{ data: 'tx_id', render: (data) => { return `<input type="text" class="form-control-plaintext form-control-sm" value="${data}" readonly="">`; }, width: '30%', class: 'text-center desktop' },
{ data: 'tx_id', render: (data) => { return `<input type="text" class="form-control-plaintext form-control-sm" value="${escapeHtml(data)}" readonly="">`; }, width: '30%', class: 'text-center desktop' },
{ data: 'amount', render: (data) => {
let className = 'danger';
let text = 'Sended';
Expand All @@ -39,7 +39,7 @@ document.addEventListener('DOMContentLoaded', () => {
{ data: 'coinbase', className: 'none', render: (data) => { return data ? 'Yes' : 'No'; } },
{ data: 'tx_id', render: (data) => {
let btns = '';
btns += `<a class="btn btn-warning btn-sm mr-1" target="_blank" href="https://bgl.bitaps.com/${data}"><i class="icon icon-svg mr-1"></i>Explorer</a>`;
btns += `<a class="btn btn-warning btn-sm mr-1" target="_blank" href="https://bgl.bitaps.com/${encodeURIComponent(data)}"><i class="icon icon-svg mr-1"></i>Explorer</a>`;
return btns;
}, class: 'text-right desktop' },
],
Expand Down
9 changes: 9 additions & 0 deletions src/utils.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -46,6 +46,15 @@ const formHandler = ($formName, callback) => {
});
};

const escapeHtml = (value) => {
return String(value)
.replace(/&/g, '&amp;')
.replace(/</g, '&lt;')
.replace(/>/g, '&gt;')
.replace(/"/g, '&quot;')
.replace(/'/g, '&#39;');
};

const dataTableParams = {
processing: true,
renderer: 'bootstrap',
Expand Down