Changeset 3332 for branches/2.2/jabberit_messenger/jmessenger/js/trophyim.mini.js

Timestamp:

10/06/10 12:00:56 (14 years ago)

Author:

alexandrecorreia

Message:

Ticket #986 - Tratado as mensagens com tags em html para evitar ataques de XSS.

File:

• branches/2.2/jabberit_messenger/jmessenger/js/trophyim.mini.js (modified) (1 diff)

branches/2.2/jabberit_messenger/jmessenger/js/trophyim.mini.js

@@ -130 +130 @@
 {state="";chatStateOnOff=document.getElementById(jid_lower+"__chatStateOnOff");if(active.length>0&chatStateOnOff!=null)
 {chatStateOnOff.value='on';}
-var _message=document.createElement("div");var _text=Strophe.getText(elems[0]);_text=_text.replace(/onblur/gi,"EVENT_DENY");_text=_text.replace(/onchange/gi,"EVENT_DENY");_text=_text.replace(/onclick/gi,"EVENT_DENY");_text=_text.replace(/ondblclick/gi,"EVENT_DENY");_text=_text.replace(/onerror/gi,"EVENT_DENY");_text=_text.replace(/onfocus/gi,"EVENT_DENY");_text=_text.replace(/onkeydown/gi,"EVENT_DENY");_text=_text.replace(/onkeypress/gi,"EVENT_DENY");_text=_text.replace(/onkeyup/gi,"EVENT_DENY");_text=_text.replace(/onmousedown/gi,"EVENT_DENY");_text=_text.replace(/onmousemove/gi,"EVENT_DENY");_text=_text.replace(/onmouseout/gi,"EVENT_DENY");_text=_text.replace(/onmouseover/gi,"EVENT_DENY");_text=_text.replace(/onmouseup/gi,"EVENT_DENY");_text=_text.replace(/onresize/gi,"EVENT_DENY");_text=_text.replace(/onselect/gi,"EVENT_DENY");_text=_text.replace(/onunload/gi,"EVENT_DENY");_text=_text.replace(/style/gi,"EVENT_DENY");_message.innerHTML=_text;var scripts=_message.getElementsByTagName('script');for(var i=0;i<scripts.length;i++){_message.removeChild(scripts[i--]);}
-var _imgSrc=_message.getElementsByTagName('img');for(var i=0;i<_imgSrc.length;i++){_message.removeChild(_imgSrc[i--]);}
-var _Div=_message.getElementsByTagName('div');for(var i=0;i<_Div.length;i++){_message.removeChild(_Div[i--]);}
-var _Span=_message.getElementsByTagName('span');for(var i=0;i<_Span.length;i++){_message.removeChild(_Span[i--]);}
-var _Iframe=_message.getElementsByTagName('iframe');for(var i=0;i<_Iframe.length;i++){_message.removeChild(_Iframe[i--]);}
-var _aHref=_message.getElementsByTagName('a');for(var i=0;i<_aHref.length;i++){_message.removeChild(_aHref[i--]);}
+var _message=document.createElement("div");var _text=Strophe.getText(elems[0]);_text=_text.replace(/onblur/gi,"EVENT_DENY");_text=_text.replace(/onchange/gi,"EVENT_DENY");_text=_text.replace(/onclick/gi,"EVENT_DENY");_text=_text.replace(/ondblclick/gi,"EVENT_DENY");_text=_text.replace(/onerror/gi,"EVENT_DENY");_text=_text.replace(/onfocus/gi,"EVENT_DENY");_text=_text.replace(/onkeydown/gi,"EVENT_DENY");_text=_text.replace(/onkeypress/gi,"EVENT_DENY");_text=_text.replace(/onkeyup/gi,"EVENT_DENY");_text=_text.replace(/onmousedown/gi,"EVENT_DENY");_text=_text.replace(/onmousemove/gi,"EVENT_DENY");_text=_text.replace(/onmouseout/gi,"EVENT_DENY");_text=_text.replace(/onmouseover/gi,"EVENT_DENY");_text=_text.replace(/onmouseup/gi,"EVENT_DENY");_text=_text.replace(/onresize/gi,"EVENT_DENY");_text=_text.replace(/onselect/gi,"EVENT_DENY");_text=_text.replace(/onunload/gi,"EVENT_DENY");_text=_text.replace(/style/gi,"EVENT_DENY");_text=_text.replace(/img /gi,"IMG_DENY ");_text=_text.replace(/script /gi,"SCRIPT_DENY ");_text=_text.replace(/div /gi,"DIV_DENY ");_text=_text.replace(/span /gi,"SPAN_DENY ");_text=_text.replace(/iframe /gi,"IFRAME_DENY ");_message.innerHTML=_text;var scripts=_message.getElementsByTagName('script_deny');for(var i=0;i<scripts.length;i++){_message.removeChild(scripts[i--]);}
+var _imgSrc=_message.getElementsByTagName('img_deny');for(var i=0;i<_imgSrc.length;i++){_imgSrc[i].parentNode.removeChild(_imgSrc[i--]);}
+var _Div=_message.getElementsByTagName('div_deny');for(var i=0;i<_Div.length;i++){_Div[i].parentNode.removeChild(_Div[i--]);}
+var _Span=_message.getElementsByTagName('span_deny');for(var i=0;i<_Span.length;i++){_Span[i].parentNode.removeChild(_Span[i--]);}
+var _Iframe=_message.getElementsByTagName('iframe_deny');for(var i=0;i<_Iframe.length;i++){_Iframe[i].parentNode.removeChild(_Iframe[i--]);}
+var _aHref=_message.getElementsByTagName('a');for(var i=0;i<_aHref.length;i++){_aHref[i].parentNode.removeChild(_aHref[i--]);}
 _message.innerHTML=_message.innerHTML.replace(/^\s+|\s+$|^\n|\n$/g,"");_message.innerHTML=loadscript.getSmiles(_message.innerHTML);if(type=='chat'||type=='normal')
 {if(_message.hasChildNodes())