git ssb - Improve type checking · cel/ssb-viewer@45a18976

Commit 45a18976ee628f722a4322d3d7fa61970d08af4f

Improve type checking

- Make sure value is string before passing it to hyperscript,
  otherwise it could be an object with property "innerHTML" which would
  get included without escaping.
- Make sure value is truthy (or != null) before dereferencing it.
- Make sure value is array before calling array methods on it.

cel committed on 9/1/2018, 1:52:01 AM
Parent: d55a613b25d45fdb9ba202633cd669d3ab0ca37a

Files changed

render.js

changed

render.jsView
		@@ -448,23 +448,23 @@
448	448 …	h('a', { href: base + encodeURIComponent(c.vote.link) }, linkedText),
449	449 …	channel]);
450	450 …	} else if (c.type == "vote") {
451	451 …	var linkedText = "this";
452		- if (typeof c.vote.linkedText != "undefined")
	452 …	+ if (c.vote && typeof c.vote.linkedText === "string")
453	453 …	linkedText = c.vote.linkedText.substring(0, 75);
454	454 …	return h('span.status',
455	455 …	['Voted ',
456	456 …	h('a', { href: base + encodeURIComponent(c.vote.link) }, linkedText)]);
457	457 …	} else if (c.type == "contact" && c.following) {
458	458 …	var name = c.contact;
459		- if (typeof c.contactAbout != "undefined")
	459 …	+ if (c.contactAbout)
460	460 …	name = c.contactAbout.name;
461	461 …	return h('span.status',
462	462 …	['Followed ',
463	463 …	h('a', { href: base + c.contact }, name)]);
464	464 …	} else if (c.type == "contact" && !c.following) {
465	465 …	var name = c.contact;
466		- if (typeof c.contactAbout != "undefined")
	466 …	+ if (c.contactAbout)
467	467 …	name = c.contactAbout.name;
468	468 …	return h('span.status',
469	469 …	['Unfollowed ',
470	470 …	h('a', { href: base + c.contact }, name)]);
		@@ -481,9 +481,9 @@
481	481 …	}
482	482 …	else if (c.type == "issue") {
483	483 …	return [h('span.status',
484	484 …	"Created a git issue" +
485		- (c.repoName != undefined ? " in repo " + c.repoName : ""),
	485 …	+ (c.repoName ? " in repo " + c.repoName : ""),
486	486 …	renderPost(opts, id, c))];
487	487 …	}
488	488 …	else if (c.type == "git-repo") {
489	489 …	return h('span.status',
		@@ -493,17 +493,18 @@
493	493 …	var s = h('span.status');
494	494 …	s.innerHTML = "Did a git update " +
495	495 …	(c.repoName != undefined ? " in repo " + escape(c.repoName) : "") +
496	496 …	'<br>' +
WritePreview
497		- (c.commits != undefined ?
498		- c.commits.map(com => { return "-" +escape(com.title); }).join('<br>') : "");
	497 …	+ (Array.isArray(c.commits) ?
	498 …	+ c.commits.filter(Boolean).map(com => { return "-" +escape(com.title \|\| com.sha1); }).join('<br>') : "");
499	499 …	return s;
500	500 …	}
501	501 …	else if (c.type == "ssb-dns") {
502	502 …	return [h('span.status', 'Updated DNS'), renderDefault(c)];
503	503 …	}
504	504 …	else if (c.type == "pub") {
505		- return h('span.status', 'Connected to the pub ' + c.address.host);
	505 …	+ var host = c.address && c.address.host
	506 …	+ return h('span.status', 'Connected to the pub ' + host);
506	507 …	}
507	508 …	else if (c.type == "npm-packages") {
508	509 …	return [h('span.status', 'Pushed npm packages')];
509	510 …	}
		@@ -530,23 +531,24 @@
530	531 …
531	532 …	var s = h('section');
532	533 …	s.innerHTML = marked(String(c.blogContent), opts.marked)
533	534 …
534		- return [channel, h('h2', c.title), s];
	535 …	+ return [channel, h('h2', String(c.title)), s];
535	536 …	}
536	537 …	else if (c.type === 'gathering') {
537	538 …	return h('div', renderGathering(opts, id, c))
538	539 …	}
539	540 …	else return renderDefault(c);
540	541 …	}
541	542 …
542	543 …	function renderGathering(opts, id, c) {
543		- const title = h('h2', c.about.title)
544		- const time = h('h3', new Date(c.about.startDateTime.epoch).toUTCString())
	544 …	+ const title = h('h2', String(c.about.title))
	545 …	+ const startEpoch = c.about.startDateTime && c.about.startDateTime.epoch
	546 …	+ const time = startEpoch ? h('h3', new Date(startEpoch).toUTCString()) : ''
545	547 …	const image = h('p', h('img', { src: opts.img_base + c.about.image }))
546	548 …	const attending = h('h3.attending', c.numberAttending + ' attending')
547	549 …	const desc = h('div')
548		- desc.innerHTML = marked(c.about.description, opts.marked)
	550 …	+ desc.innerHTML = marked(String(c.about.description), opts.marked)
549	551 …	return h('section',
550	552 …	[title,
551	553 …	time,
552	554 …	image,

Built with git-ssb-web

cel / ssb-viewer

Commit 45a18976ee628f722a4322d3d7fa61970d08af4f

Improve type checking

Files changed