Remove unsafe script tag replace (#1716)

atk4 · Dec 9, 2021 · a1eacc7 · a1eacc7
1 parent 987c9f2
commit a1eacc7
Show file tree

Hide file tree

Showing 6 changed files with 16 additions and 20 deletions.
diff --git a/js/src/services/api.service.js b/js/src/services/api.service.js
@@ -102,7 +102,7 @@ class ApiService {
                 }
                 if (response && response.atkjs) {
                     // Call evalResponse with proper context, js code and jQuery as $ var.
-                    atk.apiService.evalResponse.call(this, response.atkjs.replace(/<\/?script>/g, ''), jQuery);
+                    atk.apiService.evalResponse.call(this, response.atkjs, jQuery);
                 }
                 if (atk.apiService.afterSuccessCallbacks.length > 0) {
                     const self = this;

diff --git a/public/atkjs-ui.min.js b/public/atkjs-ui.min.js
diff --git a/src/App.php b/src/App.php
@@ -576,7 +576,7 @@ public function run()
 
             $this->html->template->set('title', $this->title);
             $this->html->renderAll();
-            $this->html->template->dangerouslyAppendHtml('HEAD', $this->html->getJs());
+            $this->html->template->dangerouslyAppendHtml('HEAD', $this->getTag('script', null, $this->html->getJs()));
             $this->is_rendering = false;
 
             if (isset($_GET[Callback::URL_QUERY_TARGET]) && $this->catch_runaway_callbacks) {

diff --git a/src/View.php b/src/View.php
@@ -743,7 +743,9 @@ public function render(bool $forceReturn = true): string
     {
         $this->renderAll();
 
-        return $this->getJs($forceReturn)
+        $js = $this->getJs($forceReturn);
+
+        return ($js !== '' ? $this->getApp()->getTag('script', null, $js) : '')
                . $this->renderTemplateToHtml();
     }
 
@@ -1199,7 +1201,7 @@ public function getJs(bool $forceReturn = false)
             }
         }
 
-        if (!$actions) {
+        if (count($actions) === 0) {
             return '';
         }
 
@@ -1218,7 +1220,7 @@ public function getJs(bool $forceReturn = false)
 
         $ready = new JsFunction($actions);
 
-        return '<script>' . "\n" . (new Jquery($ready))->jsRender() . "\n" . '</script>';
+        return (new Jquery($ready))->jsRender();
     }
 
     // }}}

diff --git a/src/VirtualPage.php b/src/VirtualPage.php
@@ -110,7 +110,7 @@ public function getHtml()
             if ($mode === 'popup') {
                 $this->getApp()->html->template->set('title', $this->getApp()->title);
                 $this->getApp()->html->template->dangerouslySetHtml('Content', parent::getHtml());
-                $this->getApp()->html->template->dangerouslyAppendHtml('HEAD', $this->getJs());
+                $this->getApp()->html->template->dangerouslyAppendHtml('HEAD', $this->getApp()->getTag('script', null, $this->getJs()));
 
                 $this->getApp()->terminateHtml($this->getApp()->html->template);
             }
@@ -142,7 +142,7 @@ public function getHtml()
 
         $this->getApp()->html->template->dangerouslySetHtml('Content', $this->getApp()->layout->template->renderToHtml());
 
-        $this->getApp()->html->template->dangerouslyAppendHtml('HEAD', $this->getApp()->layout->getJs());
+        $this->getApp()->html->template->dangerouslyAppendHtml('HEAD', $this->getApp()->getTag('script', null, $this->getApp()->layout->getJs()));
 
         $this->getApp()->terminateHtml($this->getApp()->html->template);
     }

diff --git a/tests/JsIntegrationTest.php b/tests/JsIntegrationTest.php
@@ -50,11 +50,9 @@ public function testBasicChain2(): void
         $j = $v->js(true)->hide();
         $v->getHtml();
 
-        $this->assertSame('<script>
-$(function() {
+        $this->assertSame('$(function() {
   $("#b").hide();
-})
-</script>', $v->getJs());
+})', $v->getJs());
     }
 
     /**
@@ -66,13 +64,11 @@ public function testBasicChain3(): void
         $v->js('click')->hide();
         $v->getHtml();
 
-        $this->assertSame('<script>
-$(function() {
+        $this->assertSame('$(function() {
   $("#b").bind("click",function() {
     $("#b").hide();
   });
-})
-</script>', $v->getJs());
+})', $v->getJs());
     }
 
     /**
@@ -87,14 +83,12 @@ public function testBasicChain4(): void
         $b1->on('click', $b2->js()->hide());
         $bb->getHtml();
 
-        $this->assertSame('<script>
-$(function() {
+        $this->assertSame('$(function() {
   $("#b1").on("click",function(event) {
     event.preventDefault();
     event.stopPropagation();
     $("#b2").hide();
   });
-})
-</script>', $bb->getJs());
+})', $bb->getJs());
     }
 }