kmx.io/prism.js/plugins/toolbar/prism-toolbar.js

• Show log

  Commit

• Hash : 17e33bc0
  Author :
  Date : 2016-11-20T12:52:54
  

  Reduce risk of XSS (#1051) * Skip non-own properties of env.attributes Use `Object.keys` instead of a for-in loop to find optional attributes. The former only grabs keys that are own properties, the latter also includes inherit properties from `Object.prototype`. This reduces the risk of XSS if an attacker somehow manages to manipulate the prototype chain of the Object prototype. * Fix root cause of XSS in autolinker plugin #1054 * command-line plugin: Safely encode attributes If an attacker has control over the values of the attributes "data-prompt", "data-user", or "data-host", then XSS was possible. This fixes the issue, by encoding quotes as the `"` entity. * show-language plugin: innerHTML -> textContent There is no need for `innerHTML` here. At best nothing happens, at worst XSS is possible (though the odds are negligible since the attacker would have to control the detected language). * toolbar plugin: innerHTML -> textContent

Download

• plugins/toolbar/prism-toolbar.js

• (function(){
  	if (typeof self === 'undefined' || !self.Prism || !self.document) {
  		return;
  	}
  
  	var callbacks = [];
  	var map = {};
  	var noop = function() {};
  
  	Prism.plugins.toolbar = {};
  
  	/**
  	 * Register a button callback with the toolbar.
  	 *
  	 * @param {string} key
  	 * @param {Object|Function} opts
  	 */
  	var registerButton = Prism.plugins.toolbar.registerButton = function (key, opts) {
  		var callback;
  
  		if (typeof opts === 'function') {
  			callback = opts;
  		} else {
  			callback = function (env) {
  				var element;
  
  				if (typeof opts.onClick === 'function') {
  					element = document.createElement('button');
  					element.type = 'button';
  					element.addEventListener('click', function () {
  						opts.onClick.call(this, env);
  					});
  				} else if (typeof opts.url === 'string') {
  					element = document.createElement('a');
  					element.href = opts.url;
  				} else {
  					element = document.createElement('span');
  				}
  
  				element.textContent = opts.text;
  
  				return element;
  			};
  		}
  
  		callbacks.push(map[key] = callback);
  	};
  
  	/**
  	 * Post-highlight Prism hook callback.
  	 *
  	 * @param env
  	 */
  	var hook = Prism.plugins.toolbar.hook = function (env) {
  		// Check if inline or actual code block (credit to line-numbers plugin)
  		var pre = env.element.parentNode;
  		if (!pre || !/pre/i.test(pre.nodeName)) {
  			return;
  		}
  
  		// Autoloader rehighlights, so only do this once.
  		if (pre.classList.contains('code-toolbar')) {
  			return;
  		}
  
  		pre.classList.add('code-toolbar');
  
  		// Setup the toolbar
  		var toolbar = document.createElement('div');
  		toolbar.classList.add('toolbar');
  
  		if (document.body.hasAttribute('data-toolbar-order')) {
  			callbacks = document.body.getAttribute('data-toolbar-order').split(',').map(function(key) {
  				return map[key] || noop;
  			});
  		}
  
  		callbacks.forEach(function(callback) {
  			var element = callback(env);
  
  			if (!element) {
  				return;
  			}
  
  			var item = document.createElement('div');
  			item.classList.add('toolbar-item');
  
  			item.appendChild(element);
  			toolbar.appendChild(item);
  		});
  
  		// Add our toolbar to the <pre> tag
  		pre.appendChild(toolbar);
  	};
  
  	registerButton('label', function(env) {
  		var pre = env.element.parentNode;
  		if (!pre || !/pre/i.test(pre.nodeName)) {
  			return;
  		}
  
  		if (!pre.hasAttribute('data-label')) {
  			return;
  		}
  
  		var element, template;
  		var text = pre.getAttribute('data-label');
  		try {
  			// Any normal text will blow up this selector.
  			template = document.querySelector('template#' + text);
  		} catch (e) {}
  
  		if (template) {
  			element = template.content;
  		} else {
  			if (pre.hasAttribute('data-url')) {
  				element = document.createElement('a');
  				element.href = pre.getAttribute('data-url');
  			} else {
  				element = document.createElement('span');
  			}
  
  			element.textContent = text;
  		}
  
  		return element;
  	});
  
  	/**
  	 * Register the toolbar with Prism.
  	 */
  	Prism.hooks.add('complete', hook);
  })();
  

Download