Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

ENH prevent default type in script tag #11446

Merged
merged 1 commit into from
Nov 19, 2024
+15 −15
Merged

ENH prevent default type in script tag #11446

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion _config/mimetypes.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -362,7 +362,7 @@ SilverStripe\Control\HTTP:
jpgm: video/jpm
jpgv: video/jpeg
jpm: video/jpm
js: application/javascript
js: text/javascript
json: application/json
jsonml: application/jsonml+json
kar: audio/midi
Expand Down
2 changes: 1 addition & 1 deletion src/Control/HTTPResponse.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -363,7 +363,7 @@ protected function htmlRedirect()
echo <<<EOT
<p>Redirecting to <a href="{$urlATT}" title="Click this link if your browser does not redirect you">{$title}</a></p>
<meta http-equiv="refresh" content="1; url={$urlATT}" />
<script type="application/javascript">setTimeout(function(){
<script>setTimeout(function(){
window.location.href = "{$urlJS}";
}, 50);</script>
EOT
Expand Down
2 changes: 1 addition & 1 deletion src/Security/CMSSecurity.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -133,7 +133,7 @@ protected function redirectToExternalLogin()
<!DOCTYPE html>
<html><body>
$message
<script type="application/javascript">
<script>
setTimeout(function(){top.location.href = "$loginURLJS";}, 0);
</script>
</body></html>
Expand Down
2 changes: 1 addition & 1 deletion src/Security/MemberAuthenticator/CMSLoginHandler.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -90,7 +90,7 @@ protected function redirectToChangePassword()
<!DOCTYPE html>
<html><body>
$message
<script type="application/javascript">
<script>
setTimeout(function(){top.location.href = "$changePasswordURLJS";}, 0);
</script>
</body></html>
Expand Down
4 changes: 2 additions & 2 deletions src/View/Requirements_Backend.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -810,7 +810,7 @@ public function includeInHTML($content)
foreach ($this->getJavascript() as $file => $attributes) {
// Build html attributes
$htmlAttributes = [
'type' => isset($attributes['type']) ? $attributes['type'] : "application/javascript",
'type' => isset($attributes['type']) ? $attributes['type'] : null,
'src' => $this->pathForFile($file),
];
if (!empty($attributes['async'])) {
Expand All @@ -832,7 +832,7 @@ public function includeInHTML($content)
// Add all inline JavaScript *after* including external files they might rely on
foreach ($this->getCustomScripts() as $key => $script) {
// Build html attributes
$customHtmlAttributes = ['type' => 'application/javascript'];
$customHtmlAttributes = [];
if (isset($this->customScriptAttributes[$key])) {
foreach ($this->customScriptAttributes[$key] as $attrKey => $attrValue) {
$customHtmlAttributes[$attrKey] = $attrValue;
Expand Down
4 changes: 2 additions & 2 deletions tests/php/Core/ConvertTest.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -102,7 +102,7 @@ public function testHtml2raw()
'Strong tags with attributes are replaced with asterisks'
);

$val3 = '<script type="application/javascript">Some really nasty javascript here</script>';
$val3 = '<script>Some really nasty javascript here</script>';
$this->assertEquals(
'',
Convert::html2raw($val3),
Expand All @@ -116,7 +116,7 @@ public function testHtml2raw()
'Style tags are completely removed'
);

$val5 = "<script type=\"application/javascript\">Some really nasty\nmultiline javascript here</script>";
$val5 = "<script>Some really nasty\nmultiline javascript here</script>";
$this->assertEquals(
'',
Convert::html2raw($val5),
Expand Down
14 changes: 7 additions & 7 deletions tests/php/View/RequirementsTest.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -392,7 +392,7 @@ public function testCustomType()
$result
);
$this->assertMatchesRegularExpression(
'#<script type="application/javascript" src=".*/javascript/RequirementsTest_b.js#',
'#<script src=".*/javascript/RequirementsTest_b.js#',
$result
);
}
Expand Down Expand Up @@ -1070,7 +1070,7 @@ public function testCommentedOutScriptTagIsIgnored()
$urlSrc = $urlGenerator->urlForResource($src);
$this->assertEquals(
'<html><head></head><body><!--<script>alert("commented out");</script>-->'
. '<h1>more content</h1><script type="application/javascript" src="' . $urlSrc
. '<h1>more content</h1><script src="' . $urlSrc
. "\"></script>\n</body></html>",
$html
);
Expand All @@ -1094,8 +1094,8 @@ public function testForceJsToBottom()
$template = '<html><head></head><body><header>My header</header><p>Body<script></script></p></body></html>';

// The expected outputs
$expectedScripts = "<script type=\"application/javascript\" src=\"http://www.mydomain.com/test.js\"></script>\n"
. "<script type=\"application/javascript\">//<![CDATA[\n"
$expectedScripts = "<script src=\"http://www.mydomain.com/test.js\"></script>\n"
. "<script>//<![CDATA[\n"
. "var globalvar = {\n\tpattern: '\\\\\$custom\\\\1'\n};\n"
. "//]]></script>\n";
$JsInHead = "<html><head>$expectedScripts</head><body><header>My header</header><p>Body<script></script></p></body></html>";
Expand Down Expand Up @@ -1407,7 +1407,7 @@ public function testSriAttributes()

/* Javascript has correct attributes */
$this->assertMatchesRegularExpression(
'#<script type="application/javascript" src=".*/javascript/RequirementsTest_a.js.*" integrity="abc" crossorigin="use-credentials"#',
'#<script src=".*/javascript/RequirementsTest_a.js.*" integrity="abc" crossorigin="use-credentials"#',
$html,
'javascript has correct sri attributes'
);
Expand Down Expand Up @@ -1454,14 +1454,14 @@ public function testUniquenessID()
);

$this->assertDoesNotMatchRegularExpression(
"#<script type=\"application/javascript\">//<!\[CDATA\[\s*Do Not Display\s*//\]\]></script>#s",
"#<script>//<!\[CDATA\[\s*Do Not Display\s*//\]\]></script>#s",
$html,
'customScript is correctly not displaying original write'
);

/* customScriptWithAttributes is overwritten by customScript */
$this->assertMatchesRegularExpression(
"#<script type=\"application/javascript\">//<!\[CDATA\[\s*Override\s*//\]\]></script>#s",
"#<script>//<!\[CDATA\[\s*Override\s*//\]\]></script>#s",
$html,
'customScript is displaying latest write and clearing attributes'
);
Expand Down