prevent script tags inside of error popup

diff --git a/planetstack/core/xoslib/static/js/xoslib/xos-util.js b/planetstack/core/xoslib/static/js/xoslib/xos-util.js
index 04bd041..6f4db85 100644 (file)
--- a/planetstack/core/xoslib/static/js/xoslib/xos-util.js
+++ b/planetstack/core/xoslib/static/js/xoslib/xos-util.js
@@ -143,6 +143,17 @@ function make_same_width(containerSelector, itemSelector) {
     $(containerSelector).find(itemSelector).each( function(index) { $(this).width(maxWidth); });
 }
 
+function strip_scripts(s) {
+    var div = document.createElement('div');\r
+    div.innerHTML = s;\r
+    var scripts = div.getElementsByTagName('script');\r
+    var i = scripts.length;\r
+    while (i--) {\r
+      scripts[i].parentNode.removeChild(scripts[i]);\r
+    }\r
+    return div.innerHTML;\r
+  }
+
 function parse_portlist(ports) {
     /* Support a list of ports in the format "protocol:port, protocol:port, ..."
         examples:

diff --git a/planetstack/core/xoslib/static/js/xoslib/xosHelper.js b/planetstack/core/xoslib/static/js/xoslib/xosHelper.js
index 7392843..384a7ed 100644 (file)
--- a/planetstack/core/xoslib/static/js/xoslib/xosHelper.js
+++ b/planetstack/core/xoslib/static/js/xoslib/xosHelper.js
@@ -150,7 +150,7 @@ XOSApplication = Marionette.Application.extend({
         if (parsed_error) {
             $("#xos-error-dialog").html(templateFromId("#xos-error-response")(parsed_error));
         } else {
-            $("#xos-error-dialog").html(templateFromId("#xos-error-rawresponse")({responseText: responseText}))
+            $("#xos-error-dialog").html(templateFromId("#xos-error-rawresponse")({responseText: strip_scripts(responseText)}))
         }
 
         $("#xos-error-dialog").dialog({