From d82b5e6b7b2c219e2fb6970454b2df72ba77fe19 Mon Sep 17 00:00:00 2001 From: "Cathy J. Fitzpatrick" Date: Sun, 14 Apr 2013 21:49:51 -0600 Subject: [PATCH] Rename sanitisation and escaping functions - `window.sanitize` is now `Tools.escapeHTML` - `window.unsanitize` is now `Tools.unescapeHTML` - `window.jsEscape` is now `Tools.escapeQuotes` - `window.htmlSanitize' is now `Tools.sanitizeHTML` - `battle.escape` has been eliminated and replaced by calls to `Tools.escapeHTML` --- js/battle.js | 79 ++++++++++++++--------------- js/battledata.js | 113 +++++++++++++++++++++--------------------- js/sim.js | 124 +++++++++++++++++++++++----------------------- js/teambuilder.js | 30 +++++------ js/utilichart.js | 22 ++++---- 5 files changed, 183 insertions(+), 185 deletions(-) diff --git a/js/battle.js b/js/battle.js index 14d15fbcf..d43569cc8 100644 --- a/js/battle.js +++ b/js/battle.js @@ -392,16 +392,16 @@ function Pokemon(species) { }; this.getName = function () { if (selfP.side.n === 0) { - return sanitize(selfP.name); + return Tools.escapeHTML(selfP.name); } else { - return "The foe's " + sanitize(selfP.name); + return "The foe's " + Tools.escapeHTML(selfP.name); } }; this.getLowerName = function () { if (selfP.side.n === 0) { - return sanitize(selfP.name); + return Tools.escapeHTML(selfP.name); } else { - return "the foe's " + sanitize(selfP.name); + return "the foe's " + Tools.escapeHTML(selfP.name); } }; this.getTitle = function () { @@ -414,7 +414,7 @@ function Pokemon(species) { return titlestring; }; this.getFullName = function (plaintext) { - var name = sanitize(selfP.name); + var name = Tools.escapeHTML(selfP.name); if (selfP.name !== selfP.species) { if (plaintext) { name += ' (' + selfP.species + ')'; @@ -1466,10 +1466,10 @@ function Battle(frame, logFrame, noPreload) { } pokemonhtml = '
' + pokemonhtml + '
'; if (selfS.n === 1) { - if (selfS.initialized) self.rightbarElem.html('
' + sanitize(selfS.name) + '
' + pokemonhtml + '
').find('.trainer').css('opacity',1); + if (selfS.initialized) self.rightbarElem.html('
' + Tools.escapeHTML(selfS.name) + '
' + pokemonhtml + '
').find('.trainer').css('opacity',1); else self.rightbarElem.find('.trainer').css('opacity',0.4); } else { - if (selfS.initialized) self.leftbarElem.html('
' + sanitize(selfS.name) + '
' + pokemonhtml + '
').find('.trainer').css('opacity',1); + if (selfS.initialized) self.leftbarElem.html('
' + Tools.escapeHTML(selfS.name) + '
' + pokemonhtml + '
').find('.trainer').css('opacity',1); else self.leftbarElem.find('.trainer').css('opacity',0.4); } }; @@ -1727,7 +1727,7 @@ function Battle(frame, logFrame, noPreload) { var gender = ''; if (pokemon.gender === 'F') gender = ' ♀'; if (pokemon.gender === 'M') gender = ' ♂'; - return '
' + sanitize(pokemon.name) + gender + (pokemon.level === 100 ? '' : ' L' + pokemon.level + '') + '
'; + return '
' + Tools.escapeHTML(pokemon.name) + gender + (pokemon.level === 100 ? '' : ' L' + pokemon.level + '') + '
'; }; this.switchIn = function (pokemon, slot) { if (slot === undefined) slot = pokemon.slot; @@ -1743,7 +1743,7 @@ function Battle(frame, logFrame, noPreload) { if (pokemon.side.n === 0) { self.message('Go! ' + pokemon.getFullName() + '!'); } else { - self.message('' + sanitize(pokemon.side.name) + ' sent out ' + pokemon.getFullName() + '!'); + self.message('' + Tools.escapeHTML(pokemon.side.name) + ' sent out ' + pokemon.getFullName() + '!'); } pokemon.sprite.animSummon(slot); @@ -1907,12 +1907,12 @@ function Battle(frame, logFrame, noPreload) { pokemon.removeVolatile('formechange'); } if (pokemon.lastmove === 'uturn' || pokemon.lastmove === 'voltswitch') { - self.message('' + pokemon.getName() + ' went back to ' + sanitize(pokemon.side.name) + '!'); + self.message('' + pokemon.getName() + ' went back to ' + Tools.escapeHTML(pokemon.side.name) + '!'); } else if (pokemon.lastmove !== 'batonpass') { if (pokemon.side.n === 0) { self.message('' + pokemon.getName() + ', come back!'); } else { - self.message('' + sanitize(pokemon.side.name) + ' withdrew ' + pokemon.getFullName() + '!'); + self.message('' + Tools.escapeHTML(pokemon.side.name) + ' withdrew ' + pokemon.getFullName() + '!'); } } selfS.lastPokemon = pokemon; @@ -2170,13 +2170,13 @@ function Battle(frame, logFrame, noPreload) { // activities // this.start = function () { - self.log('
Battle between ' + sanitize(self.p1.name) + ' and ' + sanitize(self.p2.name) + ' started!
'); + self.log('
Battle between ' + Tools.escapeHTML(self.p1.name) + ' and ' + Tools.escapeHTML(self.p2.name) + ' started!
'); if (self.startCallback) self.startCallback(self); } this.winner = function (winner) { if (self.fastForward !== -2) self.fastForwardOff(); if (winner) self.message('' + winner + ' won the battle!'); - else self.message('Tie between ' + sanitize(self.p1.name) + ' and ' + sanitize(self.p2.name) + '!'); + else self.message('Tie between ' + Tools.escapeHTML(self.p1.name) + ' and ' + Tools.escapeHTML(self.p2.name) + '!'); self.done = 1; } this.prematureEnd = function () { @@ -4164,7 +4164,7 @@ function Battle(frame, logFrame, noPreload) { break; case '-message': - actions += self.sanitize(args[1]); + actions += Tools.escapeHTML(args[1]); break; case '-anim': @@ -4448,9 +4448,6 @@ function Battle(frame, logFrame, noPreload) { self.preemptActivityQueue.push(command); self.add(command); } - this.sanitize = function (str) { - return str.replace(//g, '>'); - } this.teamPreview = function (start) { for (var k = 0; k < 2; k++) { var teamText = ''; @@ -4480,7 +4477,7 @@ function Battle(frame, logFrame, noPreload) { self.sides[k].totalPokemon = i; self.sides[k].updateSidebar(); if (teamText) { - self.log('
' + self.sanitize(self.sides[k].name) + '\'s team: ' + self.sanitize(teamText) + '
'); + self.log('
' + Tools.escapeHTML(self.sides[k].name) + '\'s team: ' + Tools.escapeHTML(teamText) + '
'); } self.spriteElems[k].html(text); } @@ -4501,7 +4498,7 @@ function Battle(frame, logFrame, noPreload) { case 'tier': if (!args[1]) args[1] = ''; for (var i in kwargs) args[1] += '['+i+'] '+kwargs[i]; - self.log('
Format:
' + self.sanitize(args[1]) + '
'); + self.log('
Format:
' + Tools.escapeHTML(args[1]) + '
'); self.tier = args[1]; break; case 'gametype': @@ -4512,11 +4509,11 @@ function Battle(frame, logFrame, noPreload) { } break; case 'variation': - self.log('
Variation: ' + self.sanitize(args[1]) + '
'); + self.log('
Variation: ' + Tools.escapeHTML(args[1]) + '
'); break; case 'rule': var ruleArgs = args[1].split(': '); - self.log('
' + self.sanitize(ruleArgs[0]) + (ruleArgs[1]?':':'') + ' ' + self.sanitize(ruleArgs[1]||'') + '
'); + self.log('
' + Tools.escapeHTML(ruleArgs[0]) + (ruleArgs[1]?':':'') + ' ' + Tools.escapeHTML(ruleArgs[1]||'') + '
'); break; case 'rated': self.rated = true; @@ -4530,9 +4527,9 @@ function Battle(frame, logFrame, noPreload) { args.shift(); var message = args.join('|'); if (message.substr(0,2) === '//') { - self.log('
' + self.sanitize(name) + ': ' + messageSanitize(message.substr(1)) + '
', preempt); + self.log('
' + Tools.escapeHTML(name) + ': ' + messageSanitize(message.substr(1)) + '
', preempt); } else if (message.substr(0,4).toLowerCase() === '/me ') { - self.log('
• ' + self.sanitize(name) + ' ' + messageSanitize(message.substr(4)) + '
', preempt); + self.log('
• ' + Tools.escapeHTML(name) + ' ' + messageSanitize(message.substr(4)) + '
', preempt); } else if (message.substr(0,14).toLowerCase() === '/data-pokemon ') { self.log('
    '+Chart.pokemonRow(Tools.getTemplate(message.substr(14)),'',{})+'
', preempt); } else if (message.substr(0,11).toLowerCase() === '/data-item ') { @@ -4542,47 +4539,47 @@ function Battle(frame, logFrame, noPreload) { } else if (message.substr(0,11).toLowerCase() === '/data-move ') { self.log('
    '+Chart.moveRow(Tools.getMove(message.substr(11)),'',{})+'
', preempt); } else { - self.log('
' + self.sanitize(name) + ': ' + messageSanitize(message) + '
', preempt); + self.log('
' + Tools.escapeHTML(name) + ': ' + messageSanitize(message) + '
', preempt); } break; case 'chatmsg': args.shift(); list = args.join('|'); - self.log('
' + self.sanitize(list) + '
', preempt); + self.log('
' + Tools.escapeHTML(list) + '
', preempt); break; case 'chatmsg-raw': case 'raw': args.shift(); list = args.join('|'); - self.log('
' + Tools.htmlSanitize(list) + '
', preempt); + self.log('
' + Tools.sanitizeHTML(list) + '
', preempt); break; case 'pm': - self.log('
' + self.sanitize(args[1]) + ': (Private to ' + sanitize(args[3]) + ') ' + messageSanitize(args[4]) + ''); + self.log('
' + Tools.escapeHTML(args[1]) + ': (Private to ' + Tools.escapeHTML(args[3]) + ') ' + messageSanitize(args[4]) + ''); break; case 'askreg': - self.log(''); + self.log(''); break; case 'inactive': self.kickingInactive = true; args.shift(); list = args.join('|'); - self.log('
' + self.sanitize(list) + '
', preempt); + self.log('
' + Tools.escapeHTML(list) + '
', preempt); break; case 'inactiveoff': self.kickingInactive = false; args.shift(); list = args.join('|'); - self.log('
' + self.sanitize(list) + '
', preempt); + self.log('
' + Tools.escapeHTML(list) + '
', preempt); break; case 'join': case 'j': case 'J': - self.log('
' + self.sanitize(args[1]) + ' joined.
', preempt); + self.log('
' + Tools.escapeHTML(args[1]) + ' joined.
', preempt); break; case 'leave': case 'l': case 'L': - self.log('
' + self.sanitize(args[1]) + ' left.
', preempt); + self.log('
' + Tools.escapeHTML(args[1]) + ' left.
', preempt); break; case 'spectator': case 'spectatorleave': @@ -4661,7 +4658,7 @@ function Battle(frame, logFrame, noPreload) { self.cantUseMove(poke, effect, move, kwargs); break; case 'message': - self.message(self.sanitize(args[1])); + self.message(Tools.escapeHTML(args[1])); break; case 'done': case '': @@ -4669,12 +4666,12 @@ function Battle(frame, logFrame, noPreload) { break; case 'error': args.shift(); - self.message('Error: ' + self.sanitize(args.join('|'))); + self.message('Error: ' + Tools.escapeHTML(args.join('|'))); self.message('Bug? Report it to the replay viewer\'s Smogon thread'); break; case 'warning': args.shift(); - self.message('Warning: ' + self.sanitize(args.join('|'))); + self.message('Warning: ' + Tools.escapeHTML(args.join('|'))); self.message('Bug? Report it to the replay viewer\'s Smogon thread'); self.activityWait(1000); break; @@ -4688,11 +4685,11 @@ function Battle(frame, logFrame, noPreload) { case 'debug': args.shift(); name = args.join(' '); - self.log('
[DEBUG] ' + self.sanitize(name) + '.
', preempt); + self.log('
[DEBUG] ' + Tools.escapeHTML(name) + '.
', preempt); break; default: self.logConsole('unknown command: ' + args[0]); - self.log('
Unknown command: ' + self.sanitize(args[0]) + '
'); + self.log('
Unknown command: ' + Tools.escapeHTML(args[0]) + '
'); break; } }; @@ -4746,17 +4743,17 @@ function Battle(frame, logFrame, noPreload) { self.runMajor(args, kwargs, preempt); } } catch (e) { - self.log('
Error parsing: ' + self.sanitize(str) + '
', preempt); + self.log('
Error parsing: ' + Tools.escapeHTML(str) + '
', preempt); if (e.stack) { var stack = ''+e.stack; stack = stack.split("\n").slice(0,2).join("\n"); - self.log('
' + self.sanitize(stack) + '
', preempt); + self.log('
' + Tools.escapeHTML(stack) + '
', preempt); } else { - self.log('
Error: ' + self.sanitize(''+e) + '
', preempt); + self.log('
Error: ' + Tools.escapeHTML(''+e) + '
', preempt); } } } else { - self.log('
' + self.sanitize(str) + '
', preempt); + self.log('
' + Tools.escapeHTML(str) + '
', preempt); } } this.endPrevAction = function () { diff --git a/js/battledata.js b/js/battledata.js index c6f970c74..f58b73b29 100644 --- a/js/battledata.js +++ b/js/battledata.js @@ -125,26 +125,8 @@ function hashColor(name) { return colorCache[name]; } -// a few library functions -function sanitize(str, jsEscapeToo) { - str = (str?''+str:''); - str = str.replace(/&/g, '&').replace(//g, '>').replace(/"/g, '"'); - if (jsEscapeToo) str = str.replace(/'/g, '\\\''); - return str; -} -function unsanitize(str) { - str = (str?''+str:''); - return str.replace(/"/g, '"').replace(/>/g, '>'). - replace(/</g, '<').replace(/&/g, '&'); -} -function jsEscape(str) { - str = (str?''+str:''); - str = str.replace(/'/g, '\\\''); - return str; -} - function messageSanitize(str) { - str = sanitize(str); + str = Tools.escapeHTML(str); // Don't format console commands (>>). if (str.substr(0, 8) === '>>') return str; // Don't format console results (<<). @@ -163,18 +145,18 @@ function messageSanitize(str) { event = 'External link'; } else { event = 'Interstice link'; - fulluri = sanitize(Tools.interstice.getURI(unsanitize(fulluri))); + fulluri = Tools.escapeHTML(Tools.interstice.getURI(Tools.unescapeHTML(fulluri))); } return '' + uri + ''; + '\', \'' + Tools.escapeQuotes(fulluri) + '\']);">' + uri + ''; }). // google [blah] // google[blah] // Google search for 'blah' replace(/(\bgoogle ?\[([^\]<]+)\])/ig, function(p0, p1, p2) { - p2 = sanitize(encodeURIComponent(unsanitize(p2))); + p2 = Tools.escapeHTML(encodeURIComponent(Tools.unescapeHTML(p2))); return '' + p1 + ''; }). @@ -182,21 +164,21 @@ function messageSanitize(str) { // gl[blah // Google search for 'blah' and visit the first result ("I'm feeling lucky") replace(/(\bgl ?\[([^\]<]+)\])/ig, function(p0, p1, p2) { - p2 = sanitize(encodeURIComponent(unsanitize(p2))); + p2 = Tools.escapeHTML(encodeURIComponent(Tools.unescapeHTML(p2))); return '' + p1 + ''; }). // wiki [blah] // Search Wikipedia for 'blah' (and visit the article for 'blah' if it exists) replace(/(\bwiki ?\[([^\]<]+)\])/ig, function(p0, p1, p2) { - p2 = sanitize(encodeURIComponent(unsanitize(p2))); + p2 = Tools.escapeHTML(encodeURIComponent(Tools.unescapeHTML(p2))); return '' + p1 + ''; }). // [[blah]] // Short form of gl[[blah]] replace(/\[\[([^< ]([^<`]*?[^< ])?)\]\]/ig, function(p0, p1) { - var q = sanitize(encodeURIComponent(unsanitize(p1))); + var q = Tools.escapeHTML(encodeURIComponent(Tools.unescapeHTML(p1))); return '' + p1 +''; }). @@ -378,32 +360,26 @@ var Tools = { return prefix + '//play.pokemonshowdown.com/'; })(), - interstice: (function() { - var patterns = (function(whitelist) { - var patterns = []; - for (var i = 0; i < whitelist.length; ++i) { - patterns.push(new RegExp('https?://([A-Za-z0-9-]*\\.)?' + - whitelist[i] + - '(/.*)?', 'i')); - } - return patterns; - })((Config && Config.whitelist) ? Config.whitelist : []); - return { - isWhitelisted: function(uri) { - for (var i = 0; i < patterns.length; ++i) { - if (patterns[i].test(uri)) { - return true; - } - } - return false; - }, - getURI: function(uri) { - return 'http://www.pokemonshowdown.com/interstice?uri=' + encodeURIComponent(uri); - } - }; - })(), + escapeHTML: function(str, jsEscapeToo) { + str = (str?''+str:''); + str = str.replace(/&/g, '&').replace(//g, '>').replace(/"/g, '"'); + if (jsEscapeToo) str = str.replace(/'/g, '\\\''); + return str; + }, - htmlSanitize: (function() { + unescapeHTML: function(str) { + str = (str?''+str:''); + return str.replace(/"/g, '"').replace(/>/g, '>'). + replace(/</g, '<').replace(/&/g, '&'); + }, + + escapeQuotes: function(str) { + str = (str?''+str:''); + str = str.replace(/'/g, '\\\''); + return str; + }, + + sanitizeHTML: (function() { var uriRewriter = function(uri) { return uri; }; @@ -457,7 +433,32 @@ var Tools = { }; })(), - safeJson: function(f) { + interstice: (function() { + var patterns = (function(whitelist) { + var patterns = []; + for (var i = 0; i < whitelist.length; ++i) { + patterns.push(new RegExp('https?://([A-Za-z0-9-]*\\.)?' + + whitelist[i] + + '(/.*)?', 'i')); + } + return patterns; + })((Config && Config.whitelist) ? Config.whitelist : []); + return { + isWhitelisted: function(uri) { + for (var i = 0; i < patterns.length; ++i) { + if (patterns[i].test(uri)) { + return true; + } + } + return false; + }, + getURI: function(uri) { + return 'http://www.pokemonshowdown.com/interstice?uri=' + encodeURIComponent(uri); + } + }; + })(), + + safeJSON: function(f) { return function(data) { if (data.length < 1) return; if (data[0] == ']') data = data.substr(1); @@ -525,7 +526,7 @@ var Tools = { effect.exists = true; } if (!effect.id) effect.id = id; - if (!effect.name) effect.name = sanitize(name); + if (!effect.name) effect.name = Tools.escapeHTML(name); if (!effect.category) effect.category = 'Effect'; if (!effect.effectType) effect.effectType = 'Effect'; } @@ -546,7 +547,7 @@ var Tools = { } if (!move.id) move.id = id; - if (!move.name) move.name = sanitize(name); + if (!move.name) move.name = Tools.escapeHTML(name); if (!move.critRatio) move.critRatio = 1; if (!move.baseType) move.baseType = move.type; @@ -566,7 +567,7 @@ var Tools = { item = (window.BattleItems && window.BattleItems[id]) || {}; if (item.name) item.exists = true; if (!item.id) item.id = id; - if (!item.name) item.name = sanitize(name); + if (!item.name) item.name = Tools.escapeHTML(name); if (!item.category) item.category = 'Effect'; if (!item.effectType) item.effectType = 'Item'; } @@ -580,7 +581,7 @@ var Tools = { ability = (window.BattleAbilities && window.BattleAbilities[id]) || {}; if (ability.name) ability.exists = true; if (!ability.id) ability.id = id; - if (!ability.name) ability.name = sanitize(name); + if (!ability.name) ability.name = Tools.escapeHTML(name); if (!ability.category) ability.category = 'Effect'; if (!ability.effectType) ability.effectType = 'Ability'; } @@ -616,7 +617,7 @@ var Tools = { template.learnset = window.BattleLearnsets[id].learnset; } if (!template.id) template.id = id; - if (!template.name) template.name = name = sanitize(name); + if (!template.name) template.name = name = Tools.escapeHTML(name); if (!template.speciesid) template.speciesid = id; if (!template.species) template.species = name; if (!template.baseSpecies) template.baseSpecies = name; diff --git a/js/sim.js b/js/sim.js index 9c5f75cd9..a031c06bb 100644 --- a/js/sim.js +++ b/js/sim.js @@ -71,7 +71,7 @@ var me = (function() { var query = actionphp + '?act=upkeep' + '&challengekeyid=' + encodeURIComponent(this.challengekeyid) + '&challenge=' + encodeURIComponent(this.challenge); - $.get(query, Tools.safeJson(function(data) { + $.get(query, Tools.safeJSON(function(data) { if (!data.username) return; if (data.loggedin) { this.registered = { @@ -520,7 +520,7 @@ function BattleRoom(id, elem) { this.updateMe = function () { if (selfR.meIdent.name !== me.name || selfR.meIdent.named !== me.named) { if (me.named) { - selfR.chatAddElem.html('
'); + selfR.chatAddElem.html('
'); selfR.chatboxElem = selfR.chatAddElem.find('textarea'); // The keypress event does not capture tab, so use keydown. selfR.chatboxElem.keydown(rooms['lobby'].formKeyDown); @@ -667,9 +667,9 @@ function BattleRoom(id, elem) { if (!pokemon) { controls += ' '; } else if (disabled || pokemon.zerohp) { - controls += ' '; + controls += ' '; } else { - controls += ' '; + controls += ' '; } } controls += '
'; @@ -687,9 +687,9 @@ function BattleRoom(id, elem) { if (!pokemon) { controls += ' '; } else if (disabled || pokemon.zerohp) { - controls += ' '; + controls += ' '; } else { - controls += ' '; + controls += ' '; } } controls += '
'; @@ -700,7 +700,7 @@ function BattleRoom(id, elem) { // Move chooser - controls += 'What will ' + sanitize(switchables[pos].name) + ' do? '+hpbar+'
'; + controls += 'What will ' + Tools.escapeHTML(switchables[pos].name) + ' do? '+hpbar+'
'; var hasMoves = false; var hasDisabled = false; controls += '
'; @@ -751,9 +751,9 @@ function BattleRoom(id, elem) { var pokemon = switchables[i]; pokemon.name = pokemon.ident.substr(4); if (pokemon.zerohp || i < selfR.battle.mySide.active.length || selfR.choiceSwitchFlags[i]) { - controls += ' '; + controls += ' '; } else { - controls += ' '; + controls += ' '; } } if (selfR.battle.mySide.pokemon.length > 6) { @@ -779,7 +779,7 @@ function BattleRoom(id, elem) { if (type === 'switch2') { controls += ' '; } - controls += 'Switch '+sanitize(switchables[pos].name)+' to:
'; + controls += 'Switch '+Tools.escapeHTML(switchables[pos].name)+' to:
'; controls += '
'; for (var i = 0; i < switchables.length; i++) { var pokemon = switchables[i]; @@ -788,9 +788,9 @@ function BattleRoom(id, elem) { break; } if (pokemon.zerohp || i < selfR.battle.mySide.active.length || selfR.choiceSwitchFlags[i]) { - controls += ' '; + controls += ' '; } else { - controls += ' '; + controls += ' '; } } controls += '
'; @@ -817,7 +817,7 @@ function BattleRoom(id, elem) { if (toId(pokemon.baseAbility) === 'illusion') { selfR.teamPreviewCount = 6; } - controls += ' '; + controls += ' '; } if (selfR.battle.teamPreviewCount) selfR.teamPreviewCount = parseInt(selfR.battle.teamPreviewCount,10); controls += ''; @@ -830,9 +830,9 @@ function BattleRoom(id, elem) { break; } if (i < selfR.teamPreviewDone) { - controls += ' '; + controls += ' '; } else { - controls += ' '; + controls += ' '; } } controls += ''; @@ -1323,7 +1323,7 @@ function Lobby(id, elem) { case 'ladder': if (!target) target = me.userid; var self = this; - $.get(actionphp + '?act=ladderget&user='+encodeURIComponent(target), Tools.safeJson(function(data) { + $.get(actionphp + '?act=ladderget&user='+encodeURIComponent(target), Tools.safeJSON(function(data) { try { var buffer = '
'; buffer += ''; @@ -1412,7 +1412,7 @@ function Lobby(id, elem) { var popupListCode = ''; var name; for (var i = 0; i < me.popups.length - 1; i++) { - name = sanitize(me.users[me.popups[i]] || me.popups[i]); + name = Tools.escapeHTML(me.users[me.popups[i]] || me.popups[i]); popupListCode += '

' + name + '

'; } if (me.curPopup === me.popups[i]) { @@ -1421,7 +1421,7 @@ function Lobby(id, elem) { me.curPopup = me.popups[i]; code += popupListCode; code += ''; - var clickableName = '' + sanitize(me.users[me.curPopup] || me.curPopup) + ''; + var clickableName = '' + Tools.escapeHTML(me.users[me.curPopup] || me.curPopup) + ''; code += '

' + clickableName + '

'; code += '
' + (me.pm[me.curPopup] || '') + '
'; if (!selfR.popupElem.children('.battle-log-add').length) { @@ -1616,7 +1616,7 @@ function Lobby(id, elem) { 'join': [], 'leave': [] }; - var clickableName = '' + sanitize(log[i].name.substr(1)) + ''; + var clickableName = '' + Tools.escapeHTML(log[i].name.substr(1)) + ''; var message = log[i].message; var isHighlighted = selfR.getHighlight(message); if (isHighlighted) { @@ -1628,7 +1628,7 @@ function Lobby(id, elem) { var highlight = isHighlighted ? ' style="background-color:#FDA;"' : ''; var chatDiv = '
'; var timestamp = selfR.getTimestamp(log[i].pm ? 'pms' : 'lobby'); - if (log[i].name.substr(0, 1) !== ' ') clickableName = '' + sanitize(log[i].name.substr(0, 1)) + ''+clickableName; + if (log[i].name.substr(0, 1) !== ' ') clickableName = '' + Tools.escapeHTML(log[i].name.substr(0, 1)) + ''+clickableName; if (log[i].pm) { var pmuserid = (userid === me.userid ? toUserid(log[i].pm) : userid); if (!me.pm[pmuserid]) me.pm[pmuserid] = ''; @@ -1650,7 +1650,7 @@ function Lobby(id, elem) { } else { selfR.updatePopup(); } - selfR.chatElem.append('
' + timestamp + '' + clickableName + ': (Private to ' + sanitize(log[i].pm) + ') ' + messageSanitize(message) + '
'); + selfR.chatElem.append('
' + timestamp + '' + clickableName + ': (Private to ' + Tools.escapeHTML(log[i].pm) + ') ' + messageSanitize(message) + '
'); //} else if (log[i].act) { // selfR.chatElem.append('
• ' + clickableName + ' ' + message + '
'); } else if (message.substr(0,2) === '//') { @@ -1700,11 +1700,11 @@ function Lobby(id, elem) { battletype = log[i].format + ' battle'; if (log[i].format === 'Random Battle') battletype = 'Random Battle'; } - selfR.chatElem.append('
' + battletype + ' started between ' + sanitize(log[i].name) + ' and ' + sanitize(log[i].name2) + '.
'); + selfR.chatElem.append('
' + battletype + ' started between ' + Tools.escapeHTML(log[i].name) + ' and ' + Tools.escapeHTML(log[i].name2) + '.
'); } else if (log[i].message) { - selfR.chatElem.append('
' + sanitize(log[i].message) + '
'); + selfR.chatElem.append('
' + Tools.escapeHTML(log[i].message) + '
'); } else if (log[i].rawMessage) { - selfR.chatElem.append('
' + Tools.htmlSanitize(log[i].rawMessage) + '
'); + selfR.chatElem.append('
' + Tools.sanitizeHTML(log[i].rawMessage) + '
'); } else if (log[i].evalRulesRedirect || log[i].evalRawMessage) { // TODO: This will be removed in due course. window.location.href = 'http://pokemonshowdown.com/rules'; @@ -1759,7 +1759,7 @@ function Lobby(id, elem) { message += ', '; } } - message += sanitize(list[j]); + message += Tools.escapeHTML(list[j]); } message += ' joined'; } @@ -1788,7 +1788,7 @@ function Lobby(id, elem) { message += ', '; } } - message += sanitize(list[j]); + message += Tools.escapeHTML(list[j]); } message += ' left
'; } @@ -1888,12 +1888,12 @@ function Lobby(id, elem) { var roomData = data.rooms[id]; var matches = selfR.parseBattleID(id); var format = (matches ? '[' + matches[1] + ']
' : ''); - var roomDesc = format + '' + sanitize(roomData.p1) + ' vs. ' + sanitize(roomData.p2) + ''; + var roomDesc = format + '' + Tools.escapeHTML(roomData.p1) + ' vs. ' + Tools.escapeHTML(roomData.p2) + ''; if (!roomData.p1) { matches = id.match(/[^0-9]([0-9]*)$/); // TODO: Fix this roomDesc = format + 'empty room ' + matches[1]; } else if (!roomData.p2) { - roomDesc = format + '' + sanitize(roomData.p1) + ''; + roomDesc = format + '' + Tools.escapeHTML(roomData.p1) + ''; } roomListCode += ''; } @@ -1935,12 +1935,12 @@ function Lobby(id, elem) { var roomData = data.rooms[id]; var matches = selfR.parseBattleID(id); var format = (matches ? '[' + matches[1] + ']
' : ''); - var roomDesc = format + '' + sanitize(roomData.p1) + ' vs. ' + sanitize(roomData.p2) + ''; + var roomDesc = format + '' + Tools.escapeHTML(roomData.p1) + ' vs. ' + Tools.escapeHTML(roomData.p2) + ''; if (!roomData.p1) { matches = id.match(/[^0-9]([0-9]*)$/); roomDesc = format + 'empty room ' + matches[1]; } else if (!roomData.p2) { - roomDesc = format + '' + sanitize(roomData.p1) + ''; + roomDesc = format + '' + Tools.escapeHTML(roomData.p1) + ''; } roomListCode += ''; i++; @@ -1996,10 +1996,10 @@ function Lobby(id, elem) { me.lastChallengeNotification = challenge.from; } selfR.selectedFormat = toId(challenge.format); - text = '
'; - text += 'Challenge from: ' + (me.users[challenge.from] || challenge.from) + '
' + sanitize(challenge.format) + '
'; + text = '
'; + text += 'Challenge from: ' + (me.users[challenge.from] || challenge.from) + '
' + Tools.escapeHTML(challenge.format) + '
'; text += '' + selfR.getTeamSelect(challenge.format) + '
'; - text += '
'; + text += '
'; } else if (me.userForm) { var userid = toUserid(me.userForm); var name = (me.users[userid] || me.userForm); @@ -2021,7 +2021,7 @@ function Lobby(id, elem) { selfR.send('/cmd roomlist'); } else { text = '
'; - text += '' + sanitize(name) + '
'; + text += '' + Tools.escapeHTML(name) + '
'; text += '' + (group || '') + '
'; text += '
'; if (userid === me.userid) { @@ -2031,7 +2031,7 @@ function Lobby(id, elem) { text += '
'; + text += '
'; } text += '
'; selfR.send('/cmd userdetails '+userid); @@ -2042,7 +2042,7 @@ function Lobby(id, elem) { var teamname = 'Random team'; if (selectedTeam >= 0) teamname = teams[selectedTeam].name; - text = '
Challenging: ' + (me.users[me.challengeTo.to] || me.challengeTo.to) + '
Format: ' + me.challengeTo.format + '
Team: ' + teamname + '
'; + text = '
Challenging: ' + (me.users[me.challengeTo.to] || me.challengeTo.to) + '
Format: ' + me.challengeTo.format + '
Team: ' + teamname + '
'; } else if (selfR.me.searching) { if (selfR.mainTopState === 'searching') return; selfR.mainTopState = 'searching'; @@ -2053,7 +2053,7 @@ function Lobby(id, elem) { for (var i=selfR.rooms.length-1; i>=0; i--) { var roomData = selfR.rooms[i]; if (!roomListCode) roomListCode += '

Watch battles

'; - var roomDesc = '[' + Tools.getEffect(roomData.format).name + ']
' + sanitize(roomData.p1) + 'vs.' + sanitize(roomData.p2) + ''; + var roomDesc = '[' + Tools.getEffect(roomData.format).name + ']
' + Tools.escapeHTML(roomData.p1) + 'vs.' + Tools.escapeHTML(roomData.p2) + ''; roomListCode += '
' + roomDesc + '
'; } if (roomListCode) roomListCode += ''; @@ -2206,15 +2206,15 @@ function Lobby(id, elem) { var text = ''; // Sanitising the `userid` here is probably unnecessary, because // IDs can't contain anything dangerous. - text += ''; - text += ''; text += ''; @@ -2292,7 +2292,7 @@ function Lobby(id, elem) { this.updateMe = function () { if (selfR.meIdent.name !== me.name || selfR.meIdent.named !== me.named) { if (me.named) { - selfR.chatAddElem.html('
'); + selfR.chatAddElem.html('
'); selfR.chatboxElem = selfR.chatAddElem.find('textarea'); // The keypress event does not capture tab, so use keydown. selfR.chatboxElem.keydown(this.formKeyDown); @@ -2494,11 +2494,11 @@ function Lobby(id, elem) { } if (format.section && format.section !== curSection) { if (curSection) text += ''; - text += ''; + text += ''; curSection = format.section; } if (!format.section && curSection) text += ''; - text += ''; + text += ''; } if (curSection) text += ''; text += ''; @@ -2528,13 +2528,13 @@ function Lobby(id, elem) { for (var i = 0; i < teams.length; i++) { var selected = (i === selfR.selectedTeam); if ((!teams[i].format && !teamFormat) || teams[i].format === teamFormat) { - text += ''; + text += ''; } } text += ''; for (var i = 0; i < teams.length; i++) { if ((!teams[i].format && !teamFormat) || teams[i].format === teamFormat) continue; - text += ''; + text += ''; } text += ''; } @@ -2604,10 +2604,10 @@ function updateMe() { //var mutebutton = ' '; var buttons = ' '; if (me.named) { - $('#userbar').html(notifybutton + ' ' + sanitize(me.name) + buttons + ' '); + $('#userbar').html(notifybutton + ' ' + Tools.escapeHTML(me.name) + buttons + ' '); me.setPersistentName(); } else { - $('#userbar').html(notifybutton + ' ' + sanitize(me.name) + buttons + ' '); + $('#userbar').html(notifybutton + ' ' + Tools.escapeHTML(me.name) + buttons + ' '); } $('#userbar').prepend('Website   Rules   '); if (rooms.lobby) { @@ -2655,14 +2655,14 @@ function updateRoomList() { if (rooms[id].battle.p1 && rooms[id].battle.p1.initialized) p1 = rooms[id].battle.p1.name; if (rooms[id].battle.p2 && rooms[id].battle.p2.initialized) p2 = rooms[id].battle.p2.name; if (p1 && p2) { - roomDesc = '' + sanitize(p1) + ' vs. ' + sanitize(p2) + ''; + roomDesc = '' + Tools.escapeHTML(p1) + ' vs. ' + Tools.escapeHTML(p2) + ''; closesize = 'close3'; } else if (p1) { - roomDesc = '' + sanitize(p1) + ' (inactive)'; + roomDesc = '' + Tools.escapeHTML(p1) + ' (inactive)'; rooms[id].notifying = false; closesize = 'close0'; } else if (p2) { - roomDesc = '' + sanitize(p2) + ' (inactive)'; + roomDesc = '' + Tools.escapeHTML(p2) + ' (inactive)'; rooms[id].notifying = false; closesize = 'close0'; } else { @@ -2718,7 +2718,7 @@ function updateResize() { } function tooltipAttrs(thing, type, ownHeight, isActive) { - return ' onmouseover="return showTooltip(\'' + sanitize(''+thing, true) + '\',\'' + type + '\', this, ' + (ownHeight ? 'true' : 'false') + ', ' + (isActive ? 'true' : 'false') + ')" onmouseout="return hideTooltip()" onmouseup="hideTooltip()"'; + return ' onmouseover="return showTooltip(\'' + Tools.escapeHTML(''+thing, true) + '\',\'' + type + '\', this, ' + (ownHeight ? 'true' : 'false') + ', ' + (isActive ? 'true' : 'false') + ')" onmouseout="return hideTooltip()" onmouseup="hideTooltip()"'; } function showTooltip(thing, type, elem, ownHeight, isActive) { @@ -3153,11 +3153,11 @@ function overlay(overlayType, data) { } else { contents += '

Register an account:

'; } - contents += '

' + (data.name || me.name) + '

'; + contents += '

' + (data.name || me.name) + '

'; contents += '

'; contents += '

'; contents += '

'; - contents += '

'; + contents += '

'; contents += '

'; selectElem = '#overlay_password'; break; @@ -3170,7 +3170,7 @@ function overlay(overlayType, data) { } else { contents += '

The name you chose is registered.

'; } - contents += '

' + data.name + '

'; + contents += '

' + data.name + '

'; contents += '

'; contents += '

'; selectElem = '#overlay_password'; @@ -3180,7 +3180,7 @@ function overlay(overlayType, data) { contents += '

'; - contents += ''; + contents += ''; var timestamps = (Tools.prefs('timestamps') || {}); contents += '

'; @@ -3230,7 +3230,7 @@ function overlay(overlayType, data) { } else if (data.reason) { contents += '

' + data.reason + '

'; } else {} - contents += '

'; + contents += '

'; contents += '

'; contents += '

'; selectElem = '#overlay_username'; @@ -3265,7 +3265,7 @@ function overlay(overlayType, data) { contents += ''; } } - contents += '

'; + contents += '

'; contents += '

'; selectElem = '#overlay_name'; break; @@ -3314,7 +3314,7 @@ function overlaySubmit(e, overlayType) { pass: $('#overlay_password').val(), challengekeyid: me.challengekeyid, challenge: me.challenge - }, Tools.safeJson(function (data) { + }, Tools.safeJSON(function (data) { if (!data) data = {}; var token = data.assertion; if (data.curuser && data.curuser.loggedin) { @@ -3378,7 +3378,7 @@ function overlaySubmit(e, overlayType) { captcha: captcha, challengekeyid: me.challengekeyid, challenge: me.challenge - }, Tools.safeJson(function (data) { + }, Tools.safeJSON(function (data) { if (!data) data = {}; var token = data.assertion; if (data.curuser && data.curuser.loggedin) { diff --git a/js/teambuilder.js b/js/teambuilder.js index c0e3db72e..7139a8119 100644 --- a/js/teambuilder.js +++ b/js/teambuilder.js @@ -80,11 +80,11 @@ function Teambuilder(id, elem) } else if (i == selfR.activePokemonIndex) { - text += ' '; + text += ' '; } else { - text += ' '; + text += ' '; } } if (selfR.activeTeam.team.length < 6 && !isAdd) @@ -95,12 +95,12 @@ function Teambuilder(id, elem) } else { - text = ' '; + text = ' '; } if (selfR.exportMode) { - text += ''; + text += ''; } else { @@ -148,7 +148,7 @@ function Teambuilder(id, elem) continue; } text += '
'; - text += ''; + text += ''; text += '
'; text += '
'; @@ -159,7 +159,7 @@ function Teambuilder(id, elem) var item = Tools.getItem(set.item); itemicon = ''; } - text += '
'+itemicon+'
'; + text += '
'+itemicon+'
'; // details text += '
'; @@ -177,17 +177,17 @@ function Teambuilder(id, elem) text += '
'; text += '
'; - text += '
'; - text += '
'; + text += '
'; + text += '
'; text += '
'; // moves if (!set.moves) set.moves = []; text += '
'; - text += '
'; - text += '
'; - text += '
'; - text += '
'; + text += '
'; + text += '
'; + text += '
'; + text += '
'; text += ''; // stats @@ -253,7 +253,7 @@ function Teambuilder(id, elem) else if (selfR.exportAllMode) { text = ' '; - text += ''; + text += ''; selfR.teamListElem.html(text); selfR.teamListElem.show(); @@ -295,11 +295,11 @@ function Teambuilder(id, elem) formatText = '['+team.format+'] '; } - text += '
    • '; } diff --git a/js/utilichart.js b/js/utilichart.js index 80a1eb8e7..31f46b2b0 100644 --- a/js/utilichart.js +++ b/js/utilichart.js @@ -67,11 +67,11 @@ function BattleChart() } }; this.pokemonRow = function(pokemon, attrs, match, isFirst) { - var text = '
  • '; + var text = '
  • '; text += ''+(pokemon.num)+' '; - var name = sanitize(pokemon.name); + var name = Tools.escapeHTML(pokemon.name); if (pokemon.forme && pokemon.baseSpecies) name = pokemon.baseSpecies; if (match.name) @@ -157,7 +157,7 @@ function BattleChart() return text; }; this.itemRow = function(item, attrs, match, isFirst) { - var text = '
  • '; + var text = '
  • '; var url = item.name.toLowerCase().replace(/ /g, '-').replace(/[^a-z-]+/g, ''); url = '/sprites/itemicons/'+url+'.png'; @@ -166,7 +166,7 @@ function BattleChart() text += ''; text += ' '; - var name = sanitize(item.name); + var name = Tools.escapeHTML(item.name); if (match.name) { @@ -181,16 +181,16 @@ function BattleChart() return text; } - text += ''+sanitize(item.shortDesc || item.desc)+' '; + text += ''+Tools.escapeHTML(item.shortDesc || item.desc)+' '; text += '
    • '; return text; }; this.abilityRow = function(ability, attrs, match, isFirst) { - var text = '
  • '; + var text = '
  • '; - var name = sanitize(ability.name); + var name = Tools.escapeHTML(ability.name); if (match.name) { name = name.substr(0, match.name.start)+''+name.substr(match.name.start, match.name.end-match.name.start)+''+name.substr(match.name.end); @@ -204,16 +204,16 @@ function BattleChart() return text; } - text += ''+sanitize(ability.shortDesc || ability.desc)+' '; + text += ''+Tools.escapeHTML(ability.shortDesc || ability.desc)+' '; text += '
    • '; return text; }; this.moveRow = function(move, attrs, match, isFirst) { - var text = '
  • '; + var text = '
  • '; - var name = sanitize(move.name); + var name = Tools.escapeHTML(move.name); var hplen = 'Hidden Power'.length; if (name.substr(0, hplen) === 'Hidden Power') name = 'Hidden Power'; if (match.name) @@ -249,7 +249,7 @@ function BattleChart() text += ''+(move.category!=='Status'?('Power
    '+(move.basePower||'—')):'')+'     '; text += 'Accuracy
    '+(move.accuracy && move.accuracy!==true?move.accuracy+'%':'—')+'     '; - text += ''+sanitize(move.shortDesc || move.desc)+' '; + text += ''+Tools.escapeHTML(move.shortDesc || move.desc)+' '; text += '
    • ';
    User: '+target+'