From dac7e7e9c8268b0d9fa212bfe881a5ce6da5385b Mon Sep 17 00:00:00 2001 From: adolfintel Date: Mon, 6 Aug 2018 18:13:13 +0200 Subject: [PATCH] Worker will now escape text from getIP, just in case... --- speedtest_worker.js | 9 +++++++-- speedtest_worker.min.js | 2 +- 2 files changed, 8 insertions(+), 3 deletions(-) diff --git a/speedtest_worker.js b/speedtest_worker.js index ea2c7b8..83a96d6 100644 --- a/speedtest_worker.js +++ b/speedtest_worker.js @@ -17,6 +17,11 @@ var ulProgress = 0 //progress of upload test 0-1 var pingProgress = 0 //progress of ping+jitter test 0-1 var testId = 'noID' //test ID (sent back by telemetry if used, the string 'noID' otherwise) +var HTML_ESCAPE_MAP={'&': '&','<': '<','>': '>','"': '"',"'": '''}; +String.prototype.escapeHtml=function(){ + return this.replace(/[&<>"']/g, function(m){return HTML_ESCAPE_MAP[m]}); +} + var log='' //telemetry log function tlog(s){log+=Date.now()+': '+s+'\n'} function twarn(s){log+=Date.now()+' WARN: '+s+'\n'; console.warn(s)} @@ -176,10 +181,10 @@ function getIp (done) { tlog("IP: "+xhr.responseText) try{ var data=JSON.parse(xhr.responseText) - clientIp=data.processedString + clientIp=data.processedString.escapeHtml() ispInfo=data.rawIspInfo }catch(e){ - clientIp = xhr.responseText + clientIp = xhr.responseText.escapeHtml() ispInfo='' } done() diff --git a/speedtest_worker.min.js b/speedtest_worker.min.js index 869afbb..efeb13d 100644 --- a/speedtest_worker.min.js +++ b/speedtest_worker.min.js @@ -1 +1 @@ -var testStatus=-1,dlStatus="",ulStatus="",pingStatus="",jitterStatus="",clientIp="",dlProgress=0,ulProgress=0,pingProgress=0,testId="noID",log="";function tlog(s){log+=Date.now()+": "+s+"\n"}function twarn(s){log+=Date.now()+" WARN: "+s+"\n",console.warn(s)}var settings={test_order:"IP_D_U",time_ul:15,time_dl:15,time_ulGraceTime:3,time_dlGraceTime:1.5,count_ping:35,url_dl:"garbage.php",url_ul:"empty.php",url_ping:"empty.php",url_getIp:"getIP.php",getIp_ispInfo:!0,getIp_ispInfo_distance:"km",xhr_dlMultistream:10,xhr_ulMultistream:3,xhr_multistreamDelay:300,xhr_ignoreErrors:1,xhr_dlUseBlob:!1,xhr_ul_blob_megabytes:20,garbagePhp_chunkSize:20,enable_quirks:!0,ping_allowPerformanceApi:!0,overheadCompensationFactor:1.06,useMebibits:!1,telemetry_level:0,url_telemetry:"telemetry/telemetry.php"},xhr=null,interval=null,test_pointer=0;function url_sep(url){return url.match(/\?/)?"&":"?"}function clearRequests(){if(tlog("stopping pending XHRs"),xhr){for(var i=0;i=settings.test_order.length)0settings.time_dl&&01e3*settings.time_dlGraceTime&&(0settings.time_ul&&01e3*settings.time_ulGraceTime&&(0":">",'"':""","'":"'"};String.prototype.escapeHtml=function(){return this.replace(/[&<>"']/g,function(m){return HTML_ESCAPE_MAP[m]})};var log="";function tlog(s){log+=Date.now()+": "+s+"\n"}function twarn(s){log+=Date.now()+" WARN: "+s+"\n",console.warn(s)}var settings={test_order:"IP_D_U",time_ul:15,time_dl:15,time_ulGraceTime:3,time_dlGraceTime:1.5,count_ping:35,url_dl:"garbage.php",url_ul:"empty.php",url_ping:"empty.php",url_getIp:"getIP.php",getIp_ispInfo:!0,getIp_ispInfo_distance:"km",xhr_dlMultistream:10,xhr_ulMultistream:3,xhr_multistreamDelay:300,xhr_ignoreErrors:1,xhr_dlUseBlob:!1,xhr_ul_blob_megabytes:20,garbagePhp_chunkSize:20,enable_quirks:!0,ping_allowPerformanceApi:!0,overheadCompensationFactor:1.06,useMebibits:!1,telemetry_level:0,url_telemetry:"telemetry/telemetry.php"},xhr=null,interval=null,test_pointer=0;function url_sep(url){return url.match(/\?/)?"&":"?"}function clearRequests(){if(tlog("stopping pending XHRs"),xhr){for(var i=0;i=settings.test_order.length)0settings.time_dl&&01e3*settings.time_dlGraceTime&&(0settings.time_ul&&01e3*settings.time_ulGraceTime&&(0