@bchr/bchr-front-lib 0.3.120 → 0.3.124

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (3) hide show
  1. package/lib/services/HttpService.js +17 -15
  2. package/package.json +1 -1
  3. package/src/services/HttpService.js +17 -15
package/lib/services/HttpService.js CHANGED
@@ -131,22 +131,24 @@ var HttpService = /*#__PURE__*/function () {
131
131
  rpcMethodName = "";
132
132
  }
133
133
 
134
- if (jsonObject) {
135
- ajaxOptions.data = jsonObject;
136
- }
134
+ if (!this.__checkJSONObjectSecurity(jsonObject)) {
135
+ if (jsonObject) {
136
+ ajaxOptions.data = jsonObject;
137
+ }
137
138
 
138
- if (ajaxOptions.rpcMethodName) {
139
- delete ajaxOptions.rpcMethodName;
140
- }
139
+ if (ajaxOptions.rpcMethodName) {
140
+ delete ajaxOptions.rpcMethodName;
141
+ }
141
142
 
142
- ajaxOptions.type = "post";
143
- ajaxOptions.dataType = "json";
143
+ ajaxOptions.type = "post";
144
+ ajaxOptions.dataType = "json";
144
145
 
145
- if (!ajaxOptions.url) {
146
- ajaxOptions.url = this.requestContextPath + rpcMethodName;
147
- }
146
+ if (!ajaxOptions.url) {
147
+ ajaxOptions.url = this.requestContextPath + rpcMethodName;
148
+ }
148
149
 
149
- return _jquery["default"].ajax(ajaxOptions);
150
+ return _jquery["default"].ajax(ajaxOptions);
151
+ }
150
152
  }
151
153
  }, {
152
154
  key: "__postForMock",
@@ -322,7 +324,7 @@ var HttpService = /*#__PURE__*/function () {
322
324
  var containsHTML = /<(noframes|noscript|object|script|video).*?<\/\2>/i.test(str);
323
325
 
324
326
  if (containsHTML) {
325
- throw new Error("不安全的输入,请检查!【" + str + "】");
327
+ throw new Error("不安全的输入,请检查!");
326
328
  }
327
329
  }
328
330
  }, {
@@ -359,10 +361,10 @@ var HttpService = /*#__PURE__*/function () {
359
361
  return;
360
362
  }
361
363
 
362
- var containsHTML = /<(br|basefont|hr|input|source|frame|param|area|meta|!--|col|link|option|base|img|wbr|!DOCTYPE).*?>|<(a|abbr|acronym|address|applet|article|aside|audio|b|bdi|bdo|big|blockquote|body|button|canvas|caption|center|cite|code|colgroup|command|datalist|dd|del|details|dfn|dialog|dir|div|dl|dt|em|embed|fieldset|figcaption|figure|font|footer|form|frameset|head|header|hgroup|h1|h2|h3|h4|h5|h6|html|i|iframe|ins|kbd|keygen|label|legend|li|map|mark|menu|meter|nav|noframes|noscript|object|ol|optgroup|output|p|pre|progress|q|rp|rt|ruby|s|samp|script|section|select|small|span|strike|strong|style|sub|summary|sup|table|tbody|td|textarea|tfoot|th|thead|time|title|tr|track|tt|u|ul|var|video).*?<\/\2>/i.test(str);
364
+ var containsHTML = /<(br|basefont|hr|input|source|frame|param|area|meta|!--|col|link|option|base|img|wbr|!DOCTYPE).*?>|<(a|abbr|acronym|address|applet|article|aside|audio|b|bdi|bdo|big|blockquote|body|button|canvas|caption|center|cite|code|colgroup|command|datalist|dd|del|details|dfn|dialog|dir|div|dl|dt|em|embed|fieldset|figcaption|figure|font|footer|form|frameset|head|header|hgroup|h1|h2|h3|h4|h5|h6|html|i|iframe|ins|kbd|keygen|label|legend|li|map|mark|menu|meter|nav|noframes|noscript|object|ol|optgroup|output|p|pre|progress|q|rp|rt|ruby|s|samp|script|section|select|small|span|strike|strong|style|sub|summary|sup|table|tbody|td|textarea|tfoot|th|thead|time|title|tr|track|tt|u|ul|var|video|svg).*?<\/\2>/i.test(str);
363
365
 
364
366
  if (containsHTML) {
365
- throw new Error("不安全的输入,请检查!【" + str + "】");
367
+ throw new Error("不安全的输入,请检查!");
366
368
  }
367
369
  }
368
370
  }, {
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@bchr/bchr-front-lib",
3
- "version": "0.3.120",
3
+ "version": "0.3.124",
4
4
  "description": "bchr front lib",
5
5
  "main": "lib/index.js",
6
6
  "scripts": {
package/src/services/HttpService.js CHANGED
@@ -114,22 +114,24 @@ class HttpService {
114
114
  rpcMethodName = "";
115
115
  }
116
116
 
117
- if (jsonObject) {
118
- ajaxOptions.data = jsonObject;
119
- }
117
+ if (!this.__checkJSONObjectSecurity(jsonObject)) {
118
+ if (jsonObject) {
119
+ ajaxOptions.data = jsonObject;
120
+ }
120
121
 
121
- if (ajaxOptions.rpcMethodName) {
122
- delete ajaxOptions.rpcMethodName;
123
- }
122
+ if (ajaxOptions.rpcMethodName) {
123
+ delete ajaxOptions.rpcMethodName;
124
+ }
124
125
 
125
- ajaxOptions.type = "post";
126
- ajaxOptions.dataType = "json";
126
+ ajaxOptions.type = "post";
127
+ ajaxOptions.dataType = "json";
127
128
 
128
- if (!ajaxOptions.url) {
129
- ajaxOptions.url = this.requestContextPath + rpcMethodName;
130
- }
129
+ if (!ajaxOptions.url) {
130
+ ajaxOptions.url = this.requestContextPath + rpcMethodName;
131
+ }
131
132
 
132
- return $.ajax(ajaxOptions);
133
+ return $.ajax(ajaxOptions);
134
+ }
133
135
  }
134
136
 
135
137
  __postForMock(mockOptions) {
@@ -301,7 +303,7 @@ class HttpService {
301
303
 
302
304
  let containsHTML = /<(noframes|noscript|object|script|video).*?<\/\2>/i.test(str);
303
305
  if (containsHTML) {
304
- throw new Error("不安全的输入,请检查!【" + str + "】");
306
+ throw new Error("不安全的输入,请检查!");
305
307
  }
306
308
  }
307
309
 
@@ -337,9 +339,9 @@ class HttpService {
337
339
  return;
338
340
  }
339
341
 
340
- let containsHTML = /<(br|basefont|hr|input|source|frame|param|area|meta|!--|col|link|option|base|img|wbr|!DOCTYPE).*?>|<(a|abbr|acronym|address|applet|article|aside|audio|b|bdi|bdo|big|blockquote|body|button|canvas|caption|center|cite|code|colgroup|command|datalist|dd|del|details|dfn|dialog|dir|div|dl|dt|em|embed|fieldset|figcaption|figure|font|footer|form|frameset|head|header|hgroup|h1|h2|h3|h4|h5|h6|html|i|iframe|ins|kbd|keygen|label|legend|li|map|mark|menu|meter|nav|noframes|noscript|object|ol|optgroup|output|p|pre|progress|q|rp|rt|ruby|s|samp|script|section|select|small|span|strike|strong|style|sub|summary|sup|table|tbody|td|textarea|tfoot|th|thead|time|title|tr|track|tt|u|ul|var|video).*?<\/\2>/i.test(str);
342
+ let containsHTML = /<(br|basefont|hr|input|source|frame|param|area|meta|!--|col|link|option|base|img|wbr|!DOCTYPE).*?>|<(a|abbr|acronym|address|applet|article|aside|audio|b|bdi|bdo|big|blockquote|body|button|canvas|caption|center|cite|code|colgroup|command|datalist|dd|del|details|dfn|dialog|dir|div|dl|dt|em|embed|fieldset|figcaption|figure|font|footer|form|frameset|head|header|hgroup|h1|h2|h3|h4|h5|h6|html|i|iframe|ins|kbd|keygen|label|legend|li|map|mark|menu|meter|nav|noframes|noscript|object|ol|optgroup|output|p|pre|progress|q|rp|rt|ruby|s|samp|script|section|select|small|span|strike|strong|style|sub|summary|sup|table|tbody|td|textarea|tfoot|th|thead|time|title|tr|track|tt|u|ul|var|video|svg).*?<\/\2>/i.test(str);
341
343
  if (containsHTML) {
342
- throw new Error("不安全的输入,请检查!【" + str + "】");
344
+ throw new Error("不安全的输入,请检查!");
343
345
  }
344
346
  }
345
347