Android/frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

am 2a959725: am d32aeafc: am 432fbcc5: docs: enforce alphanumeric strings for video id to prevent XSS bug 4399806

Browse Source 
* commit '2a959725f569147878b3a78fae77e8679c8e16fa':
  docs: enforce alphanumeric strings for video id to prevent XSS bug 4399806
This commit is contained in:
Scott Main
2011-05-13 11:01:25 -07:00
committed by Android Git Automerger
parent 74af525e40 2a959725f5
commit f5c826224b
1 changed files with 33 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files

49
docs/html/videos/index.jd
View File

@@ -62,7 +62,7 @@ $(window).history(function(e, hash) {
*/ */
function loadVideo(id, title, autoplay) { function loadVideo(id, title, autoplay) {
if($("." + id).hasClass("noplay")) { if($("." + id).hasClass("noplay")) {
console.log("noplay"); //console.log("noplay");
autoplay = false; autoplay = false;
$("." + id).removeClass("noplay"); $("." + id).removeClass("noplay");
} }
@@ -255,42 +255,59 @@ var clickVideoAttempts = 0; // Used with clickVideo()
* @param videoId The ID of the video to click * @param videoId The ID of the video to click
*/ */
function clickVideo(videoId) { function clickVideo(videoId) {
if (!isAlphaNumeric(videoId)) {
clickDefaultVideo();
return;
}
if ($("." + videoId).length != 0) { // if we find the video, click it and return if ($("." + videoId).length != 0) { // if we find the video, click it and return
$("." + videoId).addClass("noplay"); // add class to indicate we should NOT autoplay (class removed by loadVideo) $("." + videoId).addClass("noplay"); // add class to indicate we should NOT autoplay (class removed by loadVideo)
$("." + videoId + ":first").click(); $("." + videoId + ":first").click();
return; return;
} else { // if we don't find it, increment clickVideoAttempts } else { // if we don't find it, increment clickVideoAttempts
console.log("video NOT found: " + videoId); console.log("video NOT found: " + videoId);
clickVideoAttempts++; clickVideoAttempts++;
} }
// if we don't find it after 20 attempts (2 seconds), click the first feature video // if we don't find it after 20 attempts (2 seconds), click the first feature video
if (clickVideoAttempts > 10) { if (clickVideoAttempts > 10) {
console.log("video never found, clicking default..."); console.log("video never found, clicking default...");
clickVideoAttempts = 0; clickVideoAttempts = 0;
clickDefaultVideo(); clickDefaultVideo();
} else { // try again after 100 milliseconds } else { // try again after 100 milliseconds
setTimeout('clickVideo("'+videoId+'")', 100); setTimeout('clickVideo("' + videoId + '")', 100);
}
}
/* returns true if the provided text is alphanumeric, false otherwise
TODO: move this to the dev site js library */
function isAlphaNumeric(text){
var regex=/^[0-9A-Za-z]+$/; //^[a-zA-z]+$/
if(regex.test(text)){
return true;
} else {
console.log("Bogus video ID");
return false;
} }
} }
/* Click the default video that should be loaded on page load (the first video in the featured list) */ /* Click the default video that should be loaded on page load (the first video in the featured list) */
function clickDefaultVideo() { function clickDefaultVideo() {
if ($("#mainBodyRight .videoPreviews a:first").length != 0) { if ($("#mainBodyRight .videoPreviews a:first").length != 0) {
var videoId = $("#mainBodyRight .videoPreviews a:first").attr("class"); var videoId = $("#mainBodyRight .videoPreviews a:first").attr("class");
$("." + videoId).addClass("noplay"); // add class to indicate we should NOT autoplay (class removed by loadVideo) $("." + videoId).addClass("noplay"); // add class to indicate we should NOT autoplay (class removed by loadVideo)
$("." + videoId + ":first").click(); $("." + videoId + ":first").click();
return; return;
} else { // if we don't find it, increment clickVideoAttempts } else { // if we don't find it, increment clickVideoAttempts
console.log("default video NOT found"); console.log("default video NOT found");
clickVideoAttempts++; clickVideoAttempts++;
} }
// if we don't find it after 50 attempts (5 seconds), just fail // if we don't find it after 50 attempts (5 seconds), just fail
if (clickVideoAttempts > 50) { if (clickVideoAttempts > 50) {
console.log("default video never found..."); console.log("default video never found...");
} else { // try again after 100 milliseconds } else { // try again after 100 milliseconds
setTimeout('clickDefaultVideo()', 100); setTimeout('clickDefaultVideo()', 100);
} }
} }
</script> </script>