##// END OF EJS Templates
Fix XSS reported on Security list...
Fix XSS reported on Security list No CVE-ID yet August 18, 2015 ----- Reported to Quantopian by Juan Broullón <thebrowfc@gmail.com>... If you create a new folder in the iPython file browser and set Javascript code as its name the code injected will be executed. So, if I create a folder called "><img src=x onerror=alert(document.cookie)> and then I access to it, the cookies will be prompted. The XSS code is also executed if you access a link pointing directly at the folder. jik ------

File last commit:

r20657:d4563772
r21633:3ab41641
Show More
page.js
65 lines | 1.9 KiB | application/javascript | JavascriptLexer
// Copyright (c) IPython Development Team.
// Distributed under the terms of the Modified BSD License.
define([
'base/js/namespace',
'jquery',
'base/js/events',
], function(IPython, $, events){
"use strict";
var Page = function () {
this.bind_events();
};
Page.prototype.bind_events = function () {
// resize site on:
// - window resize
// - header change
// - page load
var _handle_resize = $.proxy(this._resize_site, this);
$(window).resize(_handle_resize);
// On document ready, resize codemirror.
$(document).ready(_handle_resize);
events.on('resize-header.Page', _handle_resize);
};
Page.prototype.show = function () {
/**
* The header and site divs start out hidden to prevent FLOUC.
* Main scripts should call this method after styling everything.
*/
this.show_header();
this.show_site();
};
Page.prototype.show_header = function () {
/**
* The header and site divs start out hidden to prevent FLOUC.
* Main scripts should call this method after styling everything.
* TODO: selector are hardcoded, pass as constructor argument
*/
$('div#header').css('display','block');
};
Page.prototype.show_site = function () {
/**
* The header and site divs start out hidden to prevent FLOUC.
* Main scripts should call this method after styling everything.
* TODO: selector are hardcoded, pass as constructor argument
*/
$('div#site').css('display', 'block');
this._resize_site();
};
Page.prototype._resize_site = function() {
// Update the site's size.
$('div#site').height($(window).height() - $('#header').height());
};
// Register self in the global namespace for convenience.
IPython.Page = Page;
return {'Page': Page};
});