fix: Osm username, add escaping where necessary (#1158)

* refactor: replace HTML rendering with plain text for user display name * refactor: refactor D3.js code to set text content * refactor: use .text() method to set text content in copyright element * refactor: use the .text() method to set text content in combobox options * refactor: use the .text() method to set text content userLink element * refactor: use the .text() method to set text content in conflict and label elements * refactor: use the .text() method to set text content in contributors element * refactor: reduce direct html injection * refactor: reduce direct html injection * fix: refactor contributors.js file * replace unnecessary setting of raw "html" with "text"
facebook · Oct 19, 2023 · 374debc · 374debc
1 parent f9ff458
commit 374debc
Show file tree

Hide file tree

Showing 14 changed files with 21 additions and 21 deletions.
diff --git a/modules/ui/account.js b/modules/ui/account.js
@@ -46,7 +46,7 @@ export function uiAccount(context) {
       // Add user name
       userLink.append('span')
         .attr('class', 'label')
-        .html(user.display_name);
+        .text(user.display_name);
     }
 
 

diff --git a/modules/ui/attribution.js b/modules/ui/attribution.js
@@ -53,7 +53,7 @@ export function uiAttribution(context) {
         attribution
           .append('span')
           .attr('class', 'attribution-text')
-          .html(terms_text);
+          .text(terms_text);
       })
       .merge(attributions);
 
@@ -73,7 +73,7 @@ export function uiAttribution(context) {
       .merge(copyright);
 
     copyright
-      .html(String);
+      .text(String);
   }
 
 

diff --git a/modules/ui/combobox.js b/modules/ui/combobox.js
@@ -384,7 +384,7 @@ export function uiCombobox(context, klass) {
                     return 'combobox-option ' + (d.klass || '');
                 })
                 .attr('title', function(d) { return d.title; })
-                .html(function(d) { return d.display || d.value; })
+                .text(function(d) { return d.display || d.value; })
                 .on('mouseenter', _mouseEnterHandler)
                 .on('mouseleave', _mouseLeaveHandler)
                 .merge(options)

diff --git a/modules/ui/conflicts.js b/modules/ui/conflicts.js
@@ -172,7 +172,7 @@ export function uiConflicts(context) {
             .append('a')
             .attr('class', 'conflict-description')
             .attr('href', '#')
-            .html(function(d) { return d.name; })
+            .text(function(d) { return d.name; })
             .on('click', function(d3_event, d) {
                 d3_event.preventDefault();
                 showEntityID(d.id);
@@ -254,7 +254,7 @@ export function uiConflicts(context) {
 
         labelEnter
             .append('span')
-            .html(function(d) { return d.text; });
+            .text(function(d) { return d.text; });
 
         // update
         choicesEnter

diff --git a/modules/ui/feature_list.js b/modules/ui/feature_list.js
@@ -297,12 +297,12 @@ export function uiFeatureList(context) {
       label
         .append('span')
         .attr('class', 'entity-type')
-        .html(d => d.type);
+        .text(d => d.type);
 
       label
         .append('span')
         .attr('class', 'entity-name')
-        .html(d => d.name);
+        .text(d => d.name);
 
       enter
         .style('opacity', 0)

diff --git a/modules/ui/fields/combo.js b/modules/ui/fields/combo.js
@@ -545,7 +545,7 @@ export function uiFieldCombo(context, uifield) {
             }
 
             chips.select('span')
-                .html(d => d.value);
+                .text(d => d.value);
 
             // Don't show delete '×' on the source chip for rapid features
             if (!(uifield.key === 'source' && _isRapidFeature())) {

diff --git a/modules/ui/fields/lanes.js b/modules/ui/fields/lanes.js
@@ -77,23 +77,23 @@ export function uiFieldLanes(context, uifield) {
             .append('text')
             .attr('y', 40)
             .attr('x', 14)
-            .html('▲');
+            .text('▲');
 
         enter
             .append('g')
             .attr('class', 'bothways')
             .append('text')
             .attr('y', 40)
             .attr('x', 14)
-            .html('▲▼');
+            .text('▲▼');
 
         enter
             .append('g')
             .attr('class', 'backward')
             .append('text')
             .attr('y', 40)
             .attr('x', 14)
-            .html('▼');
+            .text('▼');
 
 
         lane = lane

diff --git a/modules/ui/improveOSM_comments.js b/modules/ui/improveOSM_comments.js
@@ -58,7 +58,7 @@ export function uiImproveOsmComments(context) {
                   .attr('target', '_blank');
               }
               selection
-                .html(d => d.username);
+                .text(d => d.username);
             });
 
         metadataEnter
@@ -70,7 +70,7 @@ export function uiImproveOsmComments(context) {
           .append('div')
             .attr('class', 'comment-text')
           .append('p')
-            .html(d => d.text);
+            .text(d => d.text);
     })
     .catch(e => console.log(e)); // eslint-disable-line no-console
   }

diff --git a/modules/ui/improveOSM_details.js b/modules/ui/improveOSM_details.js
@@ -48,7 +48,7 @@ export function uiImproveOsmDetails(context) {
     descriptionEnter
       .append('div')
         .attr('class', 'qa-details-description-text')
-        .html(issueDetail);
+        .text(issueDetail);
 
     // If there are entity links in the error message..
     let relatedEntities = [];

diff --git a/modules/ui/improveOSM_header.js b/modules/ui/improveOSM_header.js
@@ -59,7 +59,7 @@ export function uiImproveOsmHeader(context) {
     headerEnter
       .append('div')
       .attr('class', 'qa-header-label')
-      .html(issueTitle);
+      .text(issueTitle);
   }
 
   improveOsmHeader.issue = function(val) {

diff --git a/modules/ui/note_editor.js b/modules/ui/note_editor.js
@@ -251,7 +251,7 @@ export function uiNoteEditor(context) {
             userLink
                 .append('a')
                 .attr('class', 'user-info')
-                .html(user.display_name)
+                .text(user.display_name)
                 .attr('href', osm.userURL(user.display_name))
                 .attr('target', '_blank');
 

diff --git a/modules/ui/panels/UiPanelHistory.js b/modules/ui/panels/UiPanelHistory.js
@@ -265,7 +265,7 @@ export class UiPanelHistory extends AbstractUiPanel {
     selection
       .append('span')
       .attr('class', 'user-name')
-      .html(userName);
+      .text(userName);
 
     let links = selection
       .append('div')

diff --git a/modules/ui/scale.js b/modules/ui/scale.js
@@ -54,7 +54,7 @@ export function uiScale(context) {
 
     selection.select('.scale-text')
       .style(isRTL ? 'right' : 'left', (scale.px + 16) + 'px')
-      .html(scale.text);
+      .text(scale.text);
   }
 
 

diff --git a/modules/ui/sections/changes.js b/modules/ui/sections/changes.js
@@ -75,15 +75,15 @@ export function uiSectionChanges(context) {
     buttons
       .append('strong')
       .attr('class', 'entity-type')
-      .html(d => {
+      .text(d => {
         const matched = context.systems.presets.match(d.entity, d.graph);
         return (matched && matched.name()) || l10n.displayType(d.entity.id);
       });
 
     buttons
       .append('span')
       .attr('class', 'entity-name')
-      .html(d => {
+      .text(d => {
         const name = l10n.displayName(d.entity.tags);
         let string = '';
         if (name !== '') {