diff options
author | Benjamin Neff <benjamin@coding4coffee.ch> | 2018-04-10 02:49:37 +0300 |
---|---|---|
committer | Benjamin Neff <benjamin@coding4coffee.ch> | 2018-04-10 02:54:29 +0300 |
commit | f4ea138a642b44c8bee4099ba8d8baccb7e112b5 (patch) | |
tree | 51eb996ce7a20cedf55a30aec63760dd6347b261 | |
parent | d031375610c9dcde6a98f5c9b2f836c2edfe8f16 (diff) |
Don't return a SafeString after truncate
-rw-r--r-- | Changelog.md | 4 | ||||
-rw-r--r-- | app/assets/javascripts/app/helpers/truncate.js | 11 | ||||
-rw-r--r-- | spec/javascripts/app/helpers/truncate_spec.js | 12 |
3 files changed, 20 insertions, 7 deletions
diff --git a/Changelog.md b/Changelog.md index 4c29c8076..d080935af 100644 --- a/Changelog.md +++ b/Changelog.md @@ -1,3 +1,7 @@ +# 0.7.4.1 + +Fixes a possible cross-site scripting issue with maliciously crafted OpenGraph metadata. + # 0.7.4.0 ## Refactor diff --git a/app/assets/javascripts/app/helpers/truncate.js b/app/assets/javascripts/app/helpers/truncate.js index 7cfa6aa59..754713491 100644 --- a/app/assets/javascripts/app/helpers/truncate.js +++ b/app/assets/javascripts/app/helpers/truncate.js @@ -1,14 +1,11 @@ (function() { app.helpers.truncate = function(passedString, length) { - if (passedString === null || passedString === undefined) { + if (passedString === null || passedString === undefined || passedString.length < length) { return passedString; } - if (passedString.length > length) { - var lastBlank = passedString.lastIndexOf(' ', length); - var trimstring = passedString.substring(0, Math.min(length, lastBlank)); - return new Handlebars.SafeString(trimstring + " ..."); - } - return new Handlebars.SafeString(passedString); + var lastBlank = passedString.lastIndexOf(" ", length); + var trimstring = passedString.substring(0, Math.min(length, lastBlank)); + return trimstring + " ..."; }; })(); diff --git a/spec/javascripts/app/helpers/truncate_spec.js b/spec/javascripts/app/helpers/truncate_spec.js index d816d9f15..00cdcf201 100644 --- a/spec/javascripts/app/helpers/truncate_spec.js +++ b/spec/javascripts/app/helpers/truncate_spec.js @@ -6,4 +6,16 @@ describe("app.helpers.truncate", function() { it("handles undefined", function() { expect(app.helpers.truncate(undefined, 123)).toEqual(undefined); }); + + it("returns a short string", function() { + expect(app.helpers.truncate("Some text", 10)).toEqual("Some text"); + }); + + it("trims a long string at a space", function() { + expect(app.helpers.truncate("Some very long text", 10)).toEqual("Some very ..."); + }); + + it("returns a string", function() { + expect(typeof app.helpers.truncate("Some very long text", 10)).toEqual("string"); + }); }); |