Merge pull request #804 from nbibler/backport-619

Backport #619 into stable/v0.6
2017-04-12 11:43:12 -04:00 · 2017-03-31 15:16:40 -04:00 · 2017-01-12 14:36:42 -05:00 · 2017-01-12 11:58:22 -05:00
13 changed files with 28 additions and 30 deletions
--- a/docs/VERSION
+++ b/docs/VERSION
@@ -1 +1 @@
-0.6.1
+0.6.2
--- a/include/input.js
+++ b/include/input.js
@@ -338,14 +338,13 @@ var Keyboard, Mouse;
                Util.addEvent(window, 'touchend', this._eventHandlers.mouseup);
                Util.addEvent(c, 'touchend', this._eventHandlers.mouseup);
                Util.addEvent(c, 'touchmove', this._eventHandlers.mousemove);
-            } else {
-                Util.addEvent(c, 'mousedown', this._eventHandlers.mousedown);
-                Util.addEvent(window, 'mouseup', this._eventHandlers.mouseup);
-                Util.addEvent(c, 'mouseup', this._eventHandlers.mouseup);
-                Util.addEvent(c, 'mousemove', this._eventHandlers.mousemove);
-                Util.addEvent(c, (Util.Engine.gecko) ? 'DOMMouseScroll' : 'mousewheel',
-                              this._eventHandlers.mousewheel);
            }
+            Util.addEvent(c, 'mousedown', this._eventHandlers.mousedown);
+            Util.addEvent(window, 'mouseup', this._eventHandlers.mouseup);
+            Util.addEvent(c, 'mouseup', this._eventHandlers.mouseup);
+            Util.addEvent(c, 'mousemove', this._eventHandlers.mousemove);
+            Util.addEvent(c, (Util.Engine.gecko) ? 'DOMMouseScroll' : 'mousewheel',
+                          this._eventHandlers.mousewheel);

            /* Work around right and middle click browser behaviors */
            Util.addEvent(document, 'click', this._eventHandlers.mousedisable);
@@ -360,14 +359,13 @@ var Keyboard, Mouse;
                Util.removeEvent(window, 'touchend', this._eventHandlers.mouseup);
                Util.removeEvent(c, 'touchend', this._eventHandlers.mouseup);
                Util.removeEvent(c, 'touchmove', this._eventHandlers.mousemove);
-            } else {
-                Util.removeEvent(c, 'mousedown', this._eventHandlers.mousedown);
-                Util.removeEvent(window, 'mouseup', this._eventHandlers.mouseup);
-                Util.removeEvent(c, 'mouseup', this._eventHandlers.mouseup);
-                Util.removeEvent(c, 'mousemove', this._eventHandlers.mousemove);
-                Util.removeEvent(c, (Util.Engine.gecko) ? 'DOMMouseScroll' : 'mousewheel',
-                                 this._eventHandlers.mousewheel);
            }
+            Util.removeEvent(c, 'mousedown', this._eventHandlers.mousedown);
+            Util.removeEvent(window, 'mouseup', this._eventHandlers.mouseup);
+            Util.removeEvent(c, 'mouseup', this._eventHandlers.mouseup);
+            Util.removeEvent(c, 'mousemove', this._eventHandlers.mousemove);
+            Util.removeEvent(c, (Util.Engine.gecko) ? 'DOMMouseScroll' : 'mousewheel',
+                             this._eventHandlers.mousewheel);

            /* Work around right and middle click browser behaviors */
            Util.removeEvent(document, 'click', this._eventHandlers.mousedisable);
--- a/include/ui.js
+++ b/include/ui.js
@@ -285,7 +285,7 @@ var UI;

            if (typeof(msg) !== 'undefined') {
                $D('noVNC_control_bar').setAttribute("class", klass);
-                $D('noVNC_status').innerHTML = msg;
+                $D('noVNC_status').textContent = msg;
            }

            UI.updateVisualState();
@@ -360,9 +360,9 @@ var UI;
            clearTimeout(UI.popupStatusTimeout);

            if (typeof text === 'string') {
-                psp.innerHTML = text;
+                psp.textContent = text;
            } else {
-                psp.innerHTML = $D('noVNC_status').innerHTML;
+                psp.textContent = $D('noVNC_status').textContent;
            }
            psp.style.display = "block";
            psp.style.left = window.innerWidth/2 -
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
  "name": "noVNC",
-  "version": "0.6.1",
+  "version": "0.6.2",
  "description": "An HTML5 VNC client",
  "main": "karma.conf.js",
  "directories": {
--- a/tests/arrays.js
+++ b/tests/arrays.js
@@ -36,7 +36,7 @@ if (Util.Engine.trident) {
 function message(str) {
    //console.log(str);
    cell = $D('messages');
-    cell.innerHTML += str + newline;
+    cell.textContent += str + newline;
    cell.scrollTop = cell.scrollHeight;
 }

--- a/tests/base64.html
+++ b/tests/base64.html
@@ -20,7 +20,7 @@
    function debug(str) {
        console.log(str);
        cell = $D('debug');
-        cell.innerHTML += str + "\n";
+        cell.textContent += str + "\n";
        cell.scrollTop = cell.scrollHeight;
    }

--- a/tests/canvas.html
+++ b/tests/canvas.html
@@ -42,7 +42,7 @@
        function message(str) {
            console.log(str);
            cell = $D('messages');
-            cell.innerHTML += msg_cnt + ": " + str + "\n";
+            cell.textContent += msg_cnt + ": " + str + "\n";
            cell.scrollTop = cell.scrollHeight;
            msg_cnt += 1;
        }
--- a/tests/cursor.html
+++ b/tests/cursor.html
@@ -35,7 +35,7 @@
    function debug(str) {
        console.log(str);
        cell = $D('debug');
-        cell.innerHTML += str + "\n";
+        cell.textContent += str + "\n";
        cell.scrollTop = cell.scrollHeight;
    }

--- a/tests/input.html
+++ b/tests/input.html
@@ -44,7 +44,7 @@
        function message(str) {
            console.log(str);
            cell = $D('messages');
-            cell.innerHTML += msg_cnt + ": " + str + newline;
+            cell.textContent += msg_cnt + ": " + str + newline;
            cell.scrollTop = cell.scrollHeight;
            msg_cnt++;
        }
--- a/tests/viewport.html
+++ b/tests/viewport.html
@@ -56,7 +56,7 @@
        function message(str) {
            console.log(str);
            cell = $D('messages');
-            cell.innerHTML += msg_cnt + ": " + str + newline;
+            cell.textContent += msg_cnt + ": " + str + newline;
            cell.scrollTop = cell.scrollHeight;
            msg_cnt++;
        }
--- a/tests/vnc_perf.html
+++ b/tests/vnc_perf.html
@@ -64,7 +64,7 @@
        function msg(str) {
            console.log(str);
            var cell = $D('messages');
-            cell.innerHTML += str + "\n";
+            cell.textContent += str + "\n";
            cell.scrollTop = cell.scrollHeight;
        }
        function dbgmsg(str) {
@@ -88,7 +88,7 @@
                    break;
            }
            if (typeof mesg !== 'undefined') {
-                $D('VNC_status').innerHTML = mesg;
+                $D('VNC_status').textContent = mesg;
            }
        }

--- a/tests/vnc_playback.html
+++ b/tests/vnc_playback.html
@@ -51,7 +51,7 @@
        function message(str) {
            console.log(str);
            var cell = $D('messages');
-            cell.innerHTML += str + "\n";
+            cell.textContent += str + "\n";
            cell.scrollTop = cell.scrollHeight;
        }

@@ -78,7 +78,7 @@
                    break;
            }
            if (typeof msg !== 'undefined') {
-                $D('VNC_status').innerHTML = msg;
+                $D('VNC_status').textContent = msg;
            }
        }

--- a/vnc_auto.html
+++ b/vnc_auto.html
@@ -152,7 +152,7 @@

            if (typeof(msg) !== 'undefined') {
                sb.setAttribute("class", "noVNC_status_" + level);
-                s.innerHTML = msg;
+                s.textContent = msg;
            }
        }
Author	SHA1	Message	Date
Solly Ross	5b78c230f9	Merge pull request #804 from nbibler/backport-619 Backport #619 into stable/v0.6	2017-04-12 11:43:12 -04:00
Nathaniel Bibler	4389e1fa07	Backport #619 into stable/v0.6	2017-03-31 15:16:40 -04:00
Solly Ross	e8986fa069	Release v0.6.2 Fixes a XSS vulnerability in the noVNC status display which could allow remote VNC servers to inject arbitrary HTML into the noVNC display page.	2017-01-12 14:36:42 -05:00
Solly Ross	15ce2f71eb	Use textContent instead of innerHTML Previously, setting `innerHTML` was used to display the statuses. These could include content communicated from the remote VNC server, allowing the remove VNC server to inject HTML into the noVNC page. This commit switches all uses of `innerHTML` to use `textContent`, which is not vulnerable to the HTML injection.	2017-01-12 11:58:22 -05:00
@@ -1 +1 @@
 .6.1
 .6.2