Skip to content

Commit 062df3c

Browse files
xssfoxxssfox
committed
first xss clean up
1 parent 5807193 commit 062df3c

File tree

2 files changed

+127
-70
lines changed

2 files changed

+127
-70
lines changed

‎js/app.js‎

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -486,20 +486,20 @@ var format_time_friendly = function(start, end) {
486486
var format_coordinates = function(lat, lon, name) {
487487
var coords_text;
488488
var ua = navigator.userAgent.toLowerCase();
489-
489+
var span = document.createElement('span')
490+
var a = document.createElement("a")
491+
span.appendChild(a)
490492
// determine how to link the coordinates to a native app, if on a mobile device
491493
if(ua.indexOf('iphone') > -1) {
492-
coords_text = '<a href="maps://?q='+lat+','+lon+'">' +
493-
roundNumber(lat, 5) + ', ' + roundNumber(lon, 5) +'</a>';
494+
a.href = 'maps://?q='+lat+','+lon
494495
} else if(ua.indexOf('android') > -1) {
495-
coords_text = '<a href="geo:'+lat+','+lon+'?q='+lat+','+lon+'('+name+')">' +
496-
roundNumber(lat, 5) + ', ' + roundNumber(lon, 5) +'</a>';
496+
a.href = 'geo:'+lat+','+lon+'?q='+lat+','+lon+'('+name+')'
497497
} else {
498-
coords_text = '<a href="https://www.google.com/maps/search/?api=1&query='+lat+','+lon+'" target="_blank" rel="noopener noreferrer">' +
499-
roundNumber(lat, 5) + ', ' + roundNumber(lon, 5) +'</a>';
498+
a.href = 'https://www.google.com/maps/search/?api=1&query='+lat+','+lon+'" target="_blank" rel="noopener noreferrer">'
500499
}
500+
a.innerText = roundNumber(lat, 5) + ', ' + roundNumber(lon, 5)
501501

502-
return coords_text;
502+
return span.innerHTML;
503503
};
504504

505505
// runs every second

‎js/sondehub.js‎

Lines changed: 119 additions & 62 deletions
Original file line numberDiff line numberDiff line change
@@ -1100,7 +1100,7 @@ function load() {
11001100
var img = this._createImg(this.options['iconUrl']);
11011101
var numdiv = document.createElement('div');
11021102
numdiv.setAttribute ( "class", "number" );
1103-
numdiv.innerHTML = this.options['number'] || '';
1103+
numdiv.innerText = this.options['number'] || '';
11041104
div.appendChild ( img );
11051105
div.appendChild ( numdiv );
11061106
this._setIconStyles(div, 'icon');
@@ -2832,51 +2832,68 @@ function mapInfoBox_handle_path_old(vehicle, id) {
28322832
div = document.createElement('div');
28332833

28342834
html = "<div style='line-height:16px;position:relative;'>";
2835-
html += "<div>"+data.serial+" <span style=''>("+data.datetime+")</span></div>";
2835+
html += "<div><span class='old_path_serial'></span> <span style='' class=''></span></div>";
28362836
html += "<hr style='margin:5px 0px'>";
2837-
html += "<div style='margin-bottom:5px;'><b><i class='icon-location'></i>&nbsp;</b>"+format_coordinates(data.lat, data.lon, data.serial)+"</div>";
2837+
html += "<div style='margin-bottom:5px;'><b><i class='icon-location'></i> </b><span class='old_path_coords'></span></div>";
28382838

28392839
var imp = offline.get('opt_imperial');
28402840
var text_alt = Number((imp) ? Math.floor(3.2808399 * parseInt(data.alt)) : parseInt(data.alt)).toLocaleString("us");
2841-
text_alt += "&nbsp;" + ((imp) ? 'ft':'m');
2841+
text_alt += " " + ((imp) ? 'ft':'m');
28422842

2843-
html += "<div><b>Altitude:&nbsp;</b>"+text_alt+"</div>";
2844-
html += "<div><b>Time:&nbsp;</b>"+formatDate(stringToDateUTC(data.datetime))+"</div>";
2843+
html += "<div><b>Altitude: </b><span class='old_path_alt'></span></div>";
2844+
html += "<div><b>Time: </b><span class='old_path_time_short'></span></div>";
28452845

28462846
var value = vehicle.path_length;
28472847

2848-
html += "<div><b>Distance:&nbsp;</b>";
2848+
html += "<div><b>Distance: </b><span class='old_path_time_distance'></span>";
28492849

28502850
if(offline.get('opt_imperial')) {
2851-
html += Math.round(value*0.000621371192) + "&nbsp;mi";
2851+
var distance = Math.round(value*0.000621371192) + " mi";
28522852
} else {
2853-
html += Math.round(value/10)/100 + "&nbsp;km";
2853+
var distance = Math.round(value/10)/100 + " km";
28542854
}
28552855

28562856
html += "</div>";
2857-
html += "<div><b>Duration:&nbsp;</b>" + format_time_friendly(vehicle.start_time, convert_time(vehicle.curr_position.gps_time)) + "</div>";
2857+
html += "<div><b>Duration: </b><span class='old_path_duration'></span></div>";
28582858

28592859
html += "<hr style='margin:5px 0px'>";
28602860

28612861
if (data.hasOwnProperty("humidity")) {
2862-
html += "<div><b>Relative Humidity:&nbsp;</b>" + data.humidity + " %</div>";
2862+
html += "<div><b>Relative Humidity: </b><span class='old_path_humidity'></span> %</div>";
28632863
};
28642864
if (data.hasOwnProperty("temp")) {
2865-
html += "<div><b>Temperature External:&nbsp;</b>" + data.temp + "°C</div>";
2865+
html += "<div><b>Temperature External: </b><span class='old_path_temp'></span>°C</div>";
28662866
};
28672867
if (data.hasOwnProperty("comment")) {
2868-
html += "<div><b>Comment:&nbsp;</b>" + data.comment + "</div>";
2868+
html += "<div><b>Comment: </b><span class='old_path_comment'></span></div>";
28692869
};
28702870

28712871
html += "<hr style='margin:0px;margin-top:5px'>";
28722872
html += "<div style='font-size:11px;'>"
28732873

28742874
if (data.hasOwnProperty("uploader_callsign")) {
2875-
html += "<div>" + data.uploader_callsign + "</div>";
2875+
html += "<div><span class='old_path_uploader_callsign'></span></div>";
28762876
};
28772877

2878+
2879+
28782880
div.innerHTML = html;
28792881

2882+
div.getElementsByClassName("old_path_serial")[0].textContent = data.serial
2883+
div.getElementsByClassName("old_path_time")[0].textContent = "("+data.datetime+")"
2884+
div.getElementsByClassName("old_path_coords")[0].innerHTML = format_coordinates(data.lat, data.lon, data.serial)
2885+
div.getElementsByClassName("old_path_alt")[0].textContent = text_alt
2886+
div.getElementsByClassName("old_path_time_short")[0].textContent = formatDate(stringToDateUTC(data.datetime))
2887+
div.getElementsByClassName("old_path_time_distance")[0].textContent = distance
2888+
div.getElementsByClassName("old_path_duration")[0].textContent = format_time_friendly(vehicle.start_time, convert_time(vehicle.curr_position.gps_time))
2889+
div.getElementsByClassName("old_path_humidity")[0].textContent = data.humidity
2890+
div.getElementsByClassName("old_path_temp")[0].textContent = data.temp
2891+
div.getElementsByClassName("old_path_comment")[0].textContent = data.comment
2892+
2893+
if (data.hasOwnProperty("uploader_callsign")) {
2894+
div.getElementsByClassName("old_path_uploader_callsign")[0].textContent = data.uploader_callsign
2895+
}
2896+
28802897
mapInfoBox.setContent(div);
28812898
mapInfoBox.openOn(map);
28822899

@@ -2907,87 +2924,90 @@ function mapInfoBox_handle_path_new(data, vehicle, date) {
29072924
div = document.createElement('div');
29082925

29092926
html = "<div style='line-height:16px;position:relative;'>";
2910-
html += "<div>"+data.serial+" <span style=''>("+date+")</span></div>";
2927+
html += "<div><span class='new_path_serial'></span> <span style='' class='new_path_time'></span></div>";
29112928
html += "<hr style='margin:5px 0px'>";
2912-
html += "<div style='margin-bottom:5px;'><b><i class='icon-location'></i>&nbsp;</b>"+format_coordinates(data.lat, data.lon, data.serial)+"</div>";
2929+
html += "<div style='margin-bottom:5px;'><b><i class='icon-location'></i>&nbsp;</b><span class='new_path_coords'></span></div>";
29132930

29142931
var imp = offline.get('opt_imperial');
29152932
var text_alt = Number((imp) ? Math.floor(3.2808399 * parseInt(data.alt)) : parseInt(data.alt)).toLocaleString("us");
2916-
text_alt += "&nbsp;" + ((imp) ? 'ft':'m');
2933+
text_alt += " " + ((imp) ? 'ft':'m');
29172934

2918-
html += "<div><b>Altitude:&nbsp;</b>"+text_alt+"</div>";
2919-
html += "<div><b>Time:&nbsp;</b>"+formatDate(stringToDateUTC(date))+"</div>";
2935+
html += "<div><b>Altitude: </b><span class='new_path_alt'></span></div>";
2936+
html += "<div><b>Time: </b><span class='new_path_time_short'></span></div>";
29202937

29212938
var value = vehicle.path_length;
29222939

2923-
html += "<div><b>Distance:&nbsp;</b>";
2940+
html += "<div><b>Distance: </b>";
29242941

29252942
if(offline.get('opt_imperial')) {
2926-
html += Math.round(value*0.000621371192) + "&nbsp;mi";
2943+
var distance = Math.round(value*0.000621371192) + " mi";
29272944
} else {
2928-
html += Math.round(value/10)/100 + "&nbsp;km";
2945+
var distance = Math.round(value/10)/100 + " km";
29292946
}
29302947

2931-
html += "</div>";
2932-
html += "<div><b>Duration:&nbsp;</b>" + format_time_friendly(vehicle.start_time, convert_time(vehicle.curr_position.gps_time)) + "</div>";
2948+
html += "<span class='new_path_time_distance'></span></div>";
2949+
html += "<div><b>Duration: </b><span class='new_path_duration'></span></div>";
29332950

2934-
html += "<hr style='margin:5px 0px'>";
2951+
html += "<hr style='margin:5px 0px'><div class='new_path_props'></div>";
29352952

2936-
if (data.hasOwnProperty("batt")) {
2937-
html += "<div><b>Battery Voltage:&nbsp;</b>" + data.batt + " V</div>";
2938-
};
2939-
if (data.hasOwnProperty("tx_frequency")) {
2940-
html += "<div><b>TX Frequency:&nbsp;</b>" + data.tx_frequency + " MHz</div>";
2941-
} else if (data.hasOwnProperty("frequency")) {
2942-
html += "<div><b>Frequency:&nbsp;</b>" + data.frequency.toFixed(3) + " MHz</div>";
2943-
};
2944-
if (data.hasOwnProperty("humidity")) {
2945-
html += "<div><b>Relative Humidity:&nbsp;</b>" + data.humidity + " %</div>";
2946-
};
2947-
if (data.hasOwnProperty("manufacturer")) {
2948-
html += "<div><b>Manufacturer:&nbsp;</b>" + data.manufacturer + "</div>";
2949-
};
2950-
if (data.hasOwnProperty("pressure")) {
2951-
html += "<div><b>Pressure:&nbsp;</b>" + data.pressure + " Pa</div>";
2952-
};
2953-
if (data.hasOwnProperty("sats")) {
2954-
html += "<div><b>Satellites:&nbsp;</b>" + data.sats + "</div>";
2955-
};
2956-
if (data.hasOwnProperty("temp")) {
2957-
html += "<div><b>Temperature External:&nbsp;</b>" + data.temp + "°C</div>";
2958-
};
2959-
if (data.hasOwnProperty("subtype")) {
2960-
html += "<div><b>Sonde Type:&nbsp;</b>" + data.subtype + "</div>";
2961-
} else if (data.hasOwnProperty("type")) {
2962-
html += "<div><b>Sonde Type:&nbsp;</b>" + data.type + "</div>";
2963-
};
2953+
function prop(parent, field_name, description, unit="", fixed=undefined){
2954+
if (data.hasOwnProperty(field_name)){
2955+
var div = document.createElement("div")
2956+
var b = document.createElement("b")
2957+
b.innerText = description + ": "
2958+
var span = document.createElement("span")
2959+
var value = data[field_name];
2960+
if (fixed){
2961+
value = value.toFixed(fixed)
2962+
}
2963+
span.textContent = value + " " + unit
2964+
div.appendChild(b)
2965+
div.appendChild(span)
2966+
parent.appendChild(div)
2967+
return true
2968+
}
2969+
return false
2970+
}
2971+
var xdata_fields = document.createElement("div");
29642972
if (data.hasOwnProperty("xdata")) {
29652973
html += "<hr style='margin:0px;margin-top:5px'>";
29662974
html += "<div style='font-size:11px;'>"
2967-
html += "<div><b>XDATA:&nbsp;</b>" + data.xdata + "</div>";
2975+
html += "</div><div class='new_path_xdata_prop'></div>";
29682976
if (data.hasOwnProperty("pressure")) {
29692977
xdata_pressure = data.pressure;
29702978
} else {
29712979
xdata_pressure = 1100.0;
29722980
}
29732981
var tempXDATA = parseXDATA(data.xdata, xdata_pressure);
2982+
29742983
for (let field in tempXDATA) {
29752984
if (tempXDATA.hasOwnProperty(field)) {
2985+
var xdiv = document.createElement("div");
2986+
var xb = document.createElement("b");
2987+
var xs = document.createElement("span");
2988+
xdiv.appendChild(xb)
2989+
xdiv.appendChild(xs)
2990+
xdata_fields.appendChild(xdiv)
29762991
if (field == "xdata_instrument") {
2977-
html += "<div><b>XDATA Instrument:&nbsp;</b>" + tempXDATA.xdata_instrument.join(', ') + "</div>";
2992+
xb.textContent = "XDATA Instrument: "
2993+
xs.textContent = tempXDATA.xdata_instrument.join(', ')
29782994
} else {
29792995
if (globalKeys.hasOwnProperty(field)) {
29802996
if (globalSuffixes.hasOwnProperty(field)) {
2981-
html += "<div><b>" + globalKeys[field] + ":&nbsp;</b>" + tempXDATA[field] + globalSuffixes[field] + "</div>";
2997+
xb.textContent = globalKeys[field] + ": "
2998+
xs.textContent = tempXDATA[field] + globalSuffixes[field]
29822999
} else {
2983-
html += "<div><b>" + globalKeys[field] + ":&nbsp;</b>" + tempXDATA[field] + "</div>";
3000+
xb.textContent = globalKeys[field] + ": "
3001+
xs.textContent = tempXDATA[field]
29843002
}
29853003

29863004
} else {
29873005
if (globalSuffixes.hasOwnProperty(field)) {
2988-
html += "<div><b>" + guess_name(field) + ":&nbsp;</b>" + tempXDATA[field] + globalSuffixes[field] + "</div>";
3006+
xb.textContent = guess_name(field) + ": "
3007+
xs.textContent = tempXDATA[field] + globalSuffixes[field]
29893008
} else {
2990-
html += "<div><b>" + guess_name(field) + ":&nbsp;</b>" + tempXDATA[field] + "</div>";
3009+
xb.textContent = guess_name(field) + ": "
3010+
xs.textContent = tempXDATA[field]
29913011
}
29923012
}
29933013
}
@@ -3018,11 +3038,48 @@ function mapInfoBox_handle_path_new(data, vehicle, date) {
30183038
callsign_list.push(_new_call); // catch cases where there are no fields
30193039
}
30203040

3021-
callsign_list = callsign_list.join("<br /> ");
3022-
3023-
html += callsign_list + "</div>";
3041+
callsign_list = callsign_list.join("\n");
3042+
callsign_span = document.createElement("span")
3043+
callsign_span.innerText = callsign_list
30243044

30253045
div.innerHTML = html;
3046+
div.appendChild(callsign_span)
3047+
3048+
div.getElementsByClassName("new_path_serial")[0].textContent = data.serial
3049+
div.getElementsByClassName("new_path_time")[0].textContent = "("+date+")"
3050+
3051+
div.getElementsByClassName("new_path_coords")[0].innerHTML = format_coordinates(data.lat, data.lon, data.serial); // for compat we are generating safeish url in format_coordinates
3052+
3053+
div.getElementsByClassName("new_path_alt")[0].textContent = text_alt
3054+
div.getElementsByClassName("new_path_time_short")[0].textContent = formatDate(stringToDateUTC(date))
3055+
3056+
3057+
div.getElementsByClassName("new_path_time_distance")[0].textContent = distance
3058+
3059+
div.getElementsByClassName("new_path_duration")[0].textContent = format_time_friendly(vehicle.start_time, convert_time(vehicle.curr_position.gps_time))
3060+
3061+
3062+
var prop_parent = div.getElementsByClassName("new_path_props")[0]
3063+
prop(prop_parent,"batt", "Battery Voltage", "V");
3064+
3065+
if (!prop(prop_parent,"tx_frequency", "TX Frequency", "MHz", 3)){
3066+
prop(prop_parent,"frequency", "Frequency", "MHz", 3);
3067+
}
3068+
3069+
3070+
prop(prop_parent,"humidity", "Relative Humidity","%", 3);
3071+
prop(prop_parent,"manufacturer", "Manufacturer");
3072+
prop(prop_parent,"pressure", "Pressure", "Pa", 4);
3073+
prop(prop_parent,"sats", "Satellites");
3074+
prop(prop_parent,"temp", "Temperature External", "°C", 3);
3075+
3076+
if (!prop(prop_parent,"subtype", "Sonde Type")){
3077+
prop(prop_parent,"type", "Sonde Type")
3078+
}
3079+
prop(prop_parent,"xdata", "XDATA");
3080+
if (data.hasOwnProperty("xdata")) {
3081+
div.getElementsByClassName("new_path_xdata_prop")[0].appendChild(xdata_fields)
3082+
}
30263083

30273084
mapInfoBox.setContent(div);
30283085
mapInfoBox.openOn(map);

0 commit comments

Comments
 (0)