@bchr/bchr-front-lib 0.3.122 → 0.3.123

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (3) hide show
  1. package/lib/services/HttpService.js +15 -13
  2. package/package.json +1 -1
  3. package/src/services/HttpService.js +15 -13
package/lib/services/HttpService.js CHANGED
@@ -131,22 +131,24 @@ var HttpService = /*#__PURE__*/function () {
131
131
  rpcMethodName = "";
132
132
  }
133
133
 
134
- if (jsonObject) {
135
- ajaxOptions.data = jsonObject;
136
- }
134
+ if (!this.__checkJSONObjectSecurity(jsonObject)) {
135
+ if (jsonObject) {
136
+ ajaxOptions.data = jsonObject;
137
+ }
137
138
 
138
- if (ajaxOptions.rpcMethodName) {
139
- delete ajaxOptions.rpcMethodName;
140
- }
139
+ if (ajaxOptions.rpcMethodName) {
140
+ delete ajaxOptions.rpcMethodName;
141
+ }
141
142
 
142
- ajaxOptions.type = "post";
143
- ajaxOptions.dataType = "json";
143
+ ajaxOptions.type = "post";
144
+ ajaxOptions.dataType = "json";
144
145
 
145
- if (!ajaxOptions.url) {
146
- ajaxOptions.url = this.requestContextPath + rpcMethodName;
147
- }
146
+ if (!ajaxOptions.url) {
147
+ ajaxOptions.url = this.requestContextPath + rpcMethodName;
148
+ }
148
149
 
149
- return _jquery["default"].ajax(ajaxOptions);
150
+ return _jquery["default"].ajax(ajaxOptions);
151
+ }
150
152
  }
151
153
  }, {
152
154
  key: "__postForMock",
@@ -359,7 +361,7 @@ var HttpService = /*#__PURE__*/function () {
359
361
  return;
360
362
  }
361
363
 
362
- var containsHTML = /<(br|basefont|hr|input|source|frame|param|area|meta|!--|col|link|option|base|img|wbr|!DOCTYPE).*?>|<(a|abbr|acronym|address|applet|article|aside|audio|b|bdi|bdo|big|blockquote|body|button|canvas|caption|center|cite|code|colgroup|command|datalist|dd|del|details|dfn|dialog|dir|div|dl|dt|em|embed|fieldset|figcaption|figure|font|footer|form|frameset|head|header|hgroup|h1|h2|h3|h4|h5|h6|html|i|iframe|ins|kbd|keygen|label|legend|li|map|mark|menu|meter|nav|noframes|noscript|object|ol|optgroup|output|p|pre|progress|q|rp|rt|ruby|s|samp|script|section|select|small|span|strike|strong|style|sub|summary|sup|table|tbody|td|textarea|tfoot|th|thead|time|title|tr|track|tt|u|ul|var|video).*?<\/\2>/i.test(str);
364
+ var containsHTML = /<(br|basefont|hr|input|source|frame|param|area|meta|!--|col|link|option|base|img|wbr|!DOCTYPE).*?>|<(a|abbr|acronym|address|applet|article|aside|audio|b|bdi|bdo|big|blockquote|body|button|canvas|caption|center|cite|code|colgroup|command|datalist|dd|del|details|dfn|dialog|dir|div|dl|dt|em|embed|fieldset|figcaption|figure|font|footer|form|frameset|head|header|hgroup|h1|h2|h3|h4|h5|h6|html|i|iframe|ins|kbd|keygen|label|legend|li|map|mark|menu|meter|nav|noframes|noscript|object|ol|optgroup|output|p|pre|progress|q|rp|rt|ruby|s|samp|script|section|select|small|span|strike|strong|style|sub|summary|sup|table|tbody|td|textarea|tfoot|th|thead|time|title|tr|track|tt|u|ul|var|video|svg).*?<\/\2>/i.test(str);
363
365
 
364
366
  if (containsHTML) {
365
367
  throw new Error("不安全的输入,请检查!【" + str + "】");
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@bchr/bchr-front-lib",
3
- "version": "0.3.122",
3
+ "version": "0.3.123",
4
4
  "description": "bchr front lib",
5
5
  "main": "lib/index.js",
6
6
  "scripts": {
package/src/services/HttpService.js CHANGED
@@ -114,22 +114,24 @@ class HttpService {
114
114
  rpcMethodName = "";
115
115
  }
116
116
 
117
- if (jsonObject) {
118
- ajaxOptions.data = jsonObject;
119
- }
117
+ if (!this.__checkJSONObjectSecurity(jsonObject)) {
118
+ if (jsonObject) {
119
+ ajaxOptions.data = jsonObject;
120
+ }
120
121
 
121
- if (ajaxOptions.rpcMethodName) {
122
- delete ajaxOptions.rpcMethodName;
123
- }
122
+ if (ajaxOptions.rpcMethodName) {
123
+ delete ajaxOptions.rpcMethodName;
124
+ }
124
125
 
125
- ajaxOptions.type = "post";
126
- ajaxOptions.dataType = "json";
126
+ ajaxOptions.type = "post";
127
+ ajaxOptions.dataType = "json";
127
128
 
128
- if (!ajaxOptions.url) {
129
- ajaxOptions.url = this.requestContextPath + rpcMethodName;
130
- }
129
+ if (!ajaxOptions.url) {
130
+ ajaxOptions.url = this.requestContextPath + rpcMethodName;
131
+ }
131
132
 
132
- return $.ajax(ajaxOptions);
133
+ return $.ajax(ajaxOptions);
134
+ }
133
135
  }
134
136
 
135
137
  __postForMock(mockOptions) {
@@ -337,7 +339,7 @@ class HttpService {
337
339
  return;
338
340
  }
339
341
 
340
- let containsHTML = /<(br|basefont|hr|input|source|frame|param|area|meta|!--|col|link|option|base|img|wbr|!DOCTYPE).*?>|<(a|abbr|acronym|address|applet|article|aside|audio|b|bdi|bdo|big|blockquote|body|button|canvas|caption|center|cite|code|colgroup|command|datalist|dd|del|details|dfn|dialog|dir|div|dl|dt|em|embed|fieldset|figcaption|figure|font|footer|form|frameset|head|header|hgroup|h1|h2|h3|h4|h5|h6|html|i|iframe|ins|kbd|keygen|label|legend|li|map|mark|menu|meter|nav|noframes|noscript|object|ol|optgroup|output|p|pre|progress|q|rp|rt|ruby|s|samp|script|section|select|small|span|strike|strong|style|sub|summary|sup|table|tbody|td|textarea|tfoot|th|thead|time|title|tr|track|tt|u|ul|var|video).*?<\/\2>/i.test(str);
342
+ let containsHTML = /<(br|basefont|hr|input|source|frame|param|area|meta|!--|col|link|option|base|img|wbr|!DOCTYPE).*?>|<(a|abbr|acronym|address|applet|article|aside|audio|b|bdi|bdo|big|blockquote|body|button|canvas|caption|center|cite|code|colgroup|command|datalist|dd|del|details|dfn|dialog|dir|div|dl|dt|em|embed|fieldset|figcaption|figure|font|footer|form|frameset|head|header|hgroup|h1|h2|h3|h4|h5|h6|html|i|iframe|ins|kbd|keygen|label|legend|li|map|mark|menu|meter|nav|noframes|noscript|object|ol|optgroup|output|p|pre|progress|q|rp|rt|ruby|s|samp|script|section|select|small|span|strike|strong|style|sub|summary|sup|table|tbody|td|textarea|tfoot|th|thead|time|title|tr|track|tt|u|ul|var|video|svg).*?<\/\2>/i.test(str);
341
343
  if (containsHTML) {
342
344
  throw new Error("不安全的输入,请检查!【" + str + "】");
343
345
  }