github/svgedit
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix security issue by avoiding use of eval() within postMessage calls between embedAPI and main editor (also namespace the messages and protect the imagelib extension message listener from non-string messages); avoid embedAPI's unneeded randomizing of callback IDs in favor of incrementing; deprecate old embedded_svg_edit API name in favor of JS/JSLint-friendly EmbeddedSVGEdit name (and allow it to be instantiated w/o new keyword); JSLint/HTML5-ize embedAPI files, remove HTML5/browser-optional type="text/javascript", remove unused comments for embedAPI

Browse Source 
git-svn-id: http://svg-edit.googlecode.com/svn/trunk@2585 eee81c28-f429-11dd-99c0-75d572ba1ddd
This commit is contained in:
Brett Zamir
2013-10-13 23:59:32 +00:00
parent 109cbaf99b
commit ffde8814ac
4 changed files with 92 additions and 95 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
editor/svg-editor.js
View File

@@ -4571,11 +4571,16 @@
// Callback handler for embedapi.js
try {
window.addEventListener('message', function(e) {
var cbid = parseInt(e.data.substr(0, e.data.indexOf(';')), 10);
if (!e.data || typeof e.data !== 'object' || e.data.namespace !== 'svgCanvas') {
return;
}
var cbid = e.data.id,
name = e.data.name,
args = e.data.args;
try {
e.source.postMessage('SVGe'+cbid+';'+JSON.stringify(eval(e.data)), '*');
e.source.postMessage({namespace: 'svg-edit', id: cbid, result: svgCanvas[name](args)}, '*');
} catch(err) {
e.source.postMessage('SVGe'+cbid+';error:'+err.message, '*');
e.source.postMessage({namespace: 'svg-edit', id: cbid, error: err.message}, '*');
}
}, false);
} catch(err) {