Android/frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs: enforce alphanumeric strings for video id to prevent XSS

Browse Source 
bug 4399806

Change-Id: Ie55a2b40687bb68e734012cecf22de62b4f4cf7e
This commit is contained in:
Scott Main
2011-05-11 20:14:42 -07:00
parent a45e4f4df5
commit 432fbcc55f
1 changed files with 33 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files

19
docs/html/videos/index.jd
View File

@@ -62,7 +62,7 @@ $(window).history(function(e, hash) {
*/ */
function loadVideo(id, title, autoplay) { function loadVideo(id, title, autoplay) {
if($("." + id).hasClass("noplay")) { if($("." + id).hasClass("noplay")) {
console.log("noplay"); //console.log("noplay");
autoplay = false; autoplay = false;
$("." + id).removeClass("noplay"); $("." + id).removeClass("noplay");
} }
@@ -255,6 +255,11 @@ var clickVideoAttempts = 0; // Used with clickVideo()
* @param videoId The ID of the video to click * @param videoId The ID of the video to click
*/ */
function clickVideo(videoId) { function clickVideo(videoId) {
if (!isAlphaNumeric(videoId)) {
clickDefaultVideo();
return;
}
if ($("." + videoId).length != 0) { // if we find the video, click it and return if ($("." + videoId).length != 0) { // if we find the video, click it and return
$("." + videoId).addClass("noplay"); // add class to indicate we should NOT autoplay (class removed by loadVideo) $("." + videoId).addClass("noplay"); // add class to indicate we should NOT autoplay (class removed by loadVideo)
$("." + videoId + ":first").click(); $("." + videoId + ":first").click();
@@ -274,6 +279,18 @@ function clickVideo(videoId) {
} }
} }
/* returns true if the provided text is alphanumeric, false otherwise
TODO: move this to the dev site js library */
function isAlphaNumeric(text){
var regex=/^[0-9A-Za-z]+$/; //^[a-zA-z]+$/
if(regex.test(text)){
return true;
} else {
console.log("Bogus video ID");
return false;
}
}
/* Click the default video that should be loaded on page load (the first video in the featured list) */ /* Click the default video that should be loaded on page load (the first video in the featured list) */
function clickDefaultVideo() { function clickDefaultVideo() {
if ($("#mainBodyRight .videoPreviews a:first").length != 0) { if ($("#mainBodyRight .videoPreviews a:first").length != 0) {