[feature] 7 #130

himn1 · 2025-04-11T07:18:27Z

No description provided.

…date notification center to handle persistent message types.

…inRoomMembers service, introduce MaintainRoomMembersJob, and update notification handling in Loco module.

…t JSON data handling for room list in the frontend.

…a handling in frontend, and streamline room rendering logic, fixes

…entries for users already in the room.

test/dummy/frontend/js/views/user/rooms/List.js

+
+const renderRoom = (room) => {
+  const tbody = document.querySelector("#rooms_list tbody");
+  tbody.insertAdjacentHTML("beforeend", roomTmpl(room));


To fix the issue, we need to ensure that any data used to generate HTML is properly sanitized or escaped to prevent XSS vulnerabilities. The best approach is to escape the dynamic content in the roomTmpl function before it is inserted into the DOM. This can be achieved by creating a utility function to escape HTML special characters (<, >, &, ", ') and applying it to all dynamic values in the template.

Changes to be made:

Add a utility function to escape HTML special characters.

Update the roomTmpl function to use the escape function for all dynamic content.

test/dummy/frontend/js/views/user/rooms/List.js

+const reRenderRoom = (roomId) => {
+  const room = rooms.find(r => r.id === roomId);
+  const node = document.getElementById(`room_${roomId}`);
+  node.innerHTML = roomTmpl(room);


To fix the issue, we need to ensure that any data inserted into the DOM is properly sanitized or escaped to prevent XSS attacks. Instead of using innerHTML to insert the HTML string generated by roomTmpl, we can use DOM manipulation methods to create and append elements safely. This approach avoids interpreting the data as HTML and ensures that any special characters are treated as plain text.

The changes involve:

Refactoring the roomTmpl function to return a DOM element instead of an HTML string.

Updating the renderRoom and reRenderRoom functions to use the new roomTmpl implementation.

…caching

zbigh added 30 commits February 25, 2024 22:20

All tests pass

e3a1637

refactoring

fd027e3

adjust dummy app

50a18bb

[test/dummy] disable turbo drive on login forms

5716c2a

[test/dummy] turbo:load only

9586c63

[test/dummy] controller.cleanup();

3b6df57

Merge branch 'master' into 7

d163e59

update deps

b9d97e0

eslint

dd5d0ab

bug fix

ea026de

improve

d94b974

[experimental] new emit

b5223d4

emit_to -> emit in tests

60ca5b7

cut emit_to

6cebf20

Document breaking change: remove Loco.emit_to in upcoming 7.0 release

279cba9

remove Loco::Emitter

fabc39a

refactoring

1f364bb

refactoring

d359c6e

cut unused code

3532cf7

cut unused code

3bd7142

refactoring

aeb5146

README

394b18c

convert test to new emit format

ffc2dcb

[test] new emit format

e244a32

[test] new emit format

bc3bc31

refactor

ca78522

refactoring

f69833b

refactoring

859a629

bring back emit_to

dad2e0f

fix

69bad05

zbigh added 19 commits June 4, 2025 06:03

refactor

4315fc4

Refactor recipient processing and member retrieval in Loco module; up…

8eea66c

…date notification center to handle persistent message types.

persistent msgs work

4625bee

[test]

a959e9c

[test]

77ee5ed

Rubocop in progress

be7ea1a

rubocop is green

4e39723

Rails 8

e75ff82

[test] improve

14e6ff9

refactoring

90c8d39

auto leave room - in progress

b096836

[test] background job

f87d123

Refactor room member management: replace ClearRoomMembers with Mainta…

1ef9026

…inRoomMembers service, introduce MaintainRoomMembersJob, and update notification handling in Loco module.

partial

6e81508

Refactor room rendering: remove partial for room display and implemen…

8f5375a

…t JSON data handling for room list in the frontend.

[test] fix

3cd86fc

[test] Enhance room member management and rendering: improve user dat…

91a883d

…a handling in frontend, and streamline room rendering logic, fixes

[test] Enhance member addition logic in room view: prevent duplicate …

2583494

…entries for users already in the room.

[test] fix

ba96da4

github-advanced-security bot found potential problems Jul 27, 2025

View reviewed changes

test/dummy/frontend/js/views/user/rooms/List.js Fixed Show fixed Hide fixed

test/dummy/frontend/js/views/user/rooms/List.js Fixed Show fixed Hide fixed

zbigh added 4 commits July 27, 2025 08:08

[test] refactoring

fd34bdd

[test] refactoring

9cbd9f0

[test] autoleaving room

b51aca4

[test] refactoring

d6ea9b6

github-advanced-security bot found potential problems Jul 28, 2025

View reviewed changes

zbigh added 5 commits August 5, 2025 06:21

improve Turbo integration: added turbo-cache-control meta tag for no …

886fb7f

…caching

[test] fix rejoining the room

3706e48

[test] refactor

0ef490c

[test] refactor HubFinder usage: replace with FindHub service

50622b9

[test] refactor RoomWithHub initialization: use keyword arguments

8797017

@@ -7,7 +7,16 @@
+            const escapeHTML = (str) => {
+              return String(str)
+                .replace(/&/g, "&amp;")
+                .replace(/</g, "&lt;")
+                .replace(/>/g, "&gt;")
+                .replace(/"/g, "&quot;")
+                .replace(/'/g, "&#39;");
+            };
             const roomTmpl = ({ id, name, members_count, joined }) => {
               return `
-              <tr id="room_${id}">
-                <td>${name}</td>
-                <td class="members">${members_count}</td>
+              <tr id="room_${escapeHTML(id)}">
+                <td>${escapeHTML(name)}</td>
+                <td class="members">${escapeHTML(members_count)}</td>
                 <td>
@@ -16,3 +25,3 @@
                     data-method="patch"
-                    href="${joined ? `/user/rooms/${id}/leave` : `/user/rooms/${id}/join`}"
+                    href="${joined ? `/user/rooms/${escapeHTML(id)}/leave` : `/user/rooms/${escapeHTML(id)}/join`}"
                   >
@@ -25,3 +34,3 @@
                     data-confirm="R U sure?"
-                    href="/user/rooms/${id}"
+                    href="/user/rooms/${escapeHTML(id)}"
                   >

@@ -8,26 +8,35 @@
             const roomTmpl = ({ id, name, members_count, joined }) => {
-              return `
-              <tr id="room_${id}">
-                <td>${name}</td>
-                <td class="members">${members_count}</td>
-                <td>
-                  <a
-                    rel="nofollow"
-                    data-method="patch"
-                    href="${joined ? `/user/rooms/${id}/leave` : `/user/rooms/${id}/join`}"
-                  >
-                    ${joined ? 'Leave' : 'Join'}
-                  </a>
-                  |
-                  <a
-                    rel="nofollow"
-                    data-method="delete"
-                    data-confirm="R U sure?"
-                    href="/user/rooms/${id}"
-                  >
-                    Destroy
-                  </a>
-                </td>
-              </tr>
-              `;
+              const tr = document.createElement("tr");
+              tr.id = `room_${id}`;
+              const nameTd = document.createElement("td");
+              nameTd.textContent = name;
+              tr.appendChild(nameTd);
+              const membersTd = document.createElement("td");
+              membersTd.className = "members";
+              membersTd.textContent = members_count;
+              tr.appendChild(membersTd);
+              const actionsTd = document.createElement("td");
+              const joinLeaveLink = document.createElement("a");
+              joinLeaveLink.rel = "nofollow";
+              joinLeaveLink.setAttribute("data-method", "patch");
+              joinLeaveLink.href = joined ? `/user/rooms/${id}/leave` : `/user/rooms/${id}/join`;
+              joinLeaveLink.textContent = joined ? "Leave" : "Join";
+              actionsTd.appendChild(joinLeaveLink);
+              actionsTd.appendChild(document.createTextNode(" | "));
+              const destroyLink = document.createElement("a");
+              destroyLink.rel = "nofollow";
+              destroyLink.setAttribute("data-method", "delete");
+              destroyLink.setAttribute("data-confirm", "R U sure?");
+              destroyLink.href = `/user/rooms/${id}`;
+              destroyLink.textContent = "Destroy";
+              actionsTd.appendChild(destroyLink);
+              tr.appendChild(actionsTd);
+              return tr;
             };
@@ -40,3 +49,3 @@
               const tbody = document.querySelector("#rooms_list tbody");
-              tbody.insertAdjacentHTML("beforeend", roomTmpl(room));
+              tbody.appendChild(roomTmpl(room));
             }
@@ -45,4 +54,5 @@
               const room = rooms.find(r => r.id === roomId);
-              const node = document.getElementById(`room_${roomId}`);
-              node.innerHTML = roomTmpl(room);
+              const oldNode = document.getElementById(`room_${roomId}`);
+              const newNode = roomTmpl(room);
+              oldNode.replaceWith(newNode);
             };

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

[feature] 7 #130

[feature] 7 #130

Uh oh!

himn1 commented Apr 11, 2025

Uh oh!

Uh oh!

Uh oh!

Check warning

Copilot Autofix

Check warning

Copilot Autofix

Uh oh!

[feature] 7 #130

Are you sure you want to change the base?

[feature] 7 #130

Uh oh!

Conversation

himn1 commented Apr 11, 2025

Uh oh!

Uh oh!

Uh oh!

Check warning

Uh oh!

Copilot Autofix

Check warning

Uh oh!

Copilot Autofix

Uh oh!