Skip to content
This repository was archived by the owner on Oct 30, 2020. It is now read-only.

Commit 334d40c

Browse files
jonnorjonnor
authored
Merge pull request #15 from the-grid/safer-json
Safer JSON transport method
2 parents f2eb86a + d5d0c5b commit 334d40c

File tree

2 files changed

+56
-14
lines changed

2 files changed

+56
-14
lines changed

‎spec/runner.coffee‎

Lines changed: 21 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -366,7 +366,7 @@ describe 'Runner', ->
366366
chai.expect(err.message).to.contain 'TIMEOUT'
367367
done()
368368

369-
describe 'input data containing </script>', ->
369+
describe 'input data containing <script>...</script>', ->
370370
it 'should succeed', (done) ->
371371
filter = local 'return-input'
372372
input = { 'foo': 'barbaz', 'htmlscript': '<script>alert("Works!")</script>' }
@@ -376,6 +376,26 @@ describe 'Runner', ->
376376
chai.expect(solution).to.eql input
377377
done()
378378

379+
describe 'input data containing </script>...<script>', ->
380+
it 'should succeed', (done) ->
381+
filter = local 'return-input'
382+
input = { 'foo': 'barbaz', 'htmlbogusscript': '</script> <script>alert("Works!")</script> <script>' }
383+
options = {}
384+
solver.runJob filter, input, options, (err, solution, details) ->
385+
chai.expect(err).to.not.exist
386+
chai.expect(solution).to.eql input
387+
done()
388+
389+
describe 'input data containing HTML comment', ->
390+
it 'should succeed', (done) ->
391+
filter = local 'return-input'
392+
input = { 'foo': 'barbaz', 'htmlcomment': '<!-- FFOO -->' }
393+
options = {}
394+
solver.runJob filter, input, options, (err, solution, details) ->
395+
chai.expect(err).to.not.exist
396+
chai.expect(solution).to.eql input
397+
done()
398+
379399
describe 'filter with infinite loop', ->
380400
it 'should timeout and return error', (done) ->
381401
@timeout 9000

‎src/runner.coffee‎

Lines changed: 35 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,7 @@ htmlEscape = (html) ->
2222
.replace(/>/g, '&gt;')
2323
.replace(/"/g, '&quot;')
2424

25-
generateHtml = (filter, page, options) ->
25+
generateHtml = (filter, options) ->
2626

2727
library = """
2828
window.jsJobEvent = function(id, payload) {
@@ -45,6 +45,19 @@ generateHtml = (filter, page, options) ->
4545
}
4646
return obj;
4747
};
48+
var getData = function(callback) {
49+
var xhr = new XMLHttpRequest();
50+
xhr.open('GET', window.location.href+'/data', false);
51+
xhr.setRequestHeader('Content-type', 'application/json; charset=utf-8');
52+
xhr.onreadystatechange = function () {
53+
if (xhr.readyState === 4) {
54+
var json = xhr.responseText;
55+
var data = JSON.parse(json);
56+
return callback(null, data);
57+
}
58+
};
59+
xhr.send();
60+
};
4861
var sendResponse = function(err, solution, details) {
4962
var xhr = new XMLHttpRequest();
5063
xhr.open('POST', window.location.href, true);
@@ -63,20 +76,17 @@ generateHtml = (filter, page, options) ->
6376
};
6477
var main = function() {
6578
console.log('poly: main start');
66-
var dataElement = document.getElementById("poly-input-data");
67-
var json = dataElement.innerHTML.substring("<!--".length, dataElement.innerHTML.length-"-->".length);
68-
var data = JSON.parse(json);
69-
console.log('poly: starting solving');
70-
window.jsJobRun(data.page, data.options, cb);
71-
console.log('poly: started');
79+
80+
getData(function(err, data) {
81+
console.log('poly: starting solving');
82+
window.jsJobRun(data.input, data.options, cb);
83+
console.log('poly: started');
84+
});
7285
};
7386
window.onload = main;
7487
// main();
7588
"""
7689

77-
payload = { page: page, options: options }
78-
json = JSON.stringify payload, null, 4
79-
8090
scriptTags = ("<script>#{s}</script>" for s in options.scripts).join("\n")
8191
body = """<!DOCTYPE html>
8292
<html>
@@ -85,7 +95,6 @@ generateHtml = (filter, page, options) ->
8595
#{scriptTags}
8696
<script>#{library}</script>
8797
<script src="#{filter}"></script>
88-
<script id="poly-input-data" type="application/json"><!--#{json}--></script>
8998
</head>
9099
<body>
91100
<script>#{script}</script>
@@ -186,11 +195,25 @@ class Runner
186195
jobId = paths[2]
187196
if paths[3] == 'event'
188197
return @handleEventRequest jobId, request, response
198+
else if paths[3] == 'data'
199+
return @handleDataRequest jobId, request, response
189200
else
190201
return response.end()
191202
else
192203
return response.end()
193204

205+
handleDataRequest: (jobId, request, response) ->
206+
console.log "#{request.method} #{jobId}" if @options.verbose
207+
job = @jobs[jobId]
208+
if not job
209+
# multiple callbacks for same id, or wrong id
210+
debug 'could not find solve job', jobId
211+
return
212+
213+
response.writeHead 200, {"Content-Type": "application/json; charset=utf-8"}
214+
body = JSON.stringify { input: job.page, options: job.options }
215+
response.end body
216+
194217
handleSolveRequest: (jobId, request, response) ->
195218
console.log "#{request.method} #{jobId}" if @options.verbose
196219
job = @jobs[jobId]
@@ -200,9 +223,8 @@ class Runner
200223
return
201224

202225
if request.method == 'GET'
203-
# FIXME: make only for GET
204226
response.writeHead 200, {"Content-Type": "text/html; charset=utf-8"}
205-
body = generateHtml job.filter, job.page, job.options
227+
body = generateHtml job.filter, job.options
206228
response.end body
207229
else if request.method == 'POST'
208230
data = ""

0 commit comments

Comments
 (0)