bigpipe-util 0.1.4 → 0.2.0

package/CHANGELOG.md

@@ -30,3 +30,12 @@ Updates should follow the [Keep a CHANGELOG](http://keepachangelog.com/) princip
 
 ### Fixed
 - Arguments for non-method require calls
+
+## v0.2.0 - 2022-05-17
+
+### Added
+- Shield to prevent "JSON Hijacking"
+- Invalid node checking for AsyncDOM
+
+### Fixed
+- Backdrop for 2+ opened dialogs

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "bigpipe-util",
   "description": "This library currently implements small part of Facebook BigPipe so far, but the advantage is to efficiently insert/replace content and work with the DOM. It is also possible to easily call JavaScript modules from PHP.",
-  "version": "0.1.4",
+  "version": "0.2.0",
   "keywords": [
     "bigpipe",
     "xhr",

package/src/async/AsyncDOM.js

@@ -15,6 +15,11 @@ export default class AsyncDOM {
         node = (node || document.documentElement).querySelector(selector);
       }
 
+      if (!node) {
+        console.error(`Selector '${selector}' does not match anything!`)
+        continue;
+      }
+
       switch (type) {
         case "eval":
           (new Function(content)).apply(node);

package/src/async/AsyncRequest.js

@@ -121,6 +121,17 @@ AsyncRequest.prototype.abort = function () {
   }
 };
 
+AsyncRequest.prototype._unshieldResponseText = function (text) {
+  const shield = "for (;;);";
+  const shieldLength = shield.length;
+
+  if (text.length <= shieldLength) {
+    throw new Error("Response too short on async to " + this.getURI());
+  }
+
+  return text.substring(shieldLength);
+};
+
 AsyncRequest.prototype.send = function () {
   const {uri, method} = this;
   let { data } = this;
@@ -140,7 +151,8 @@ AsyncRequest.prototype.send = function () {
     if (this.status >= 200 && this.status < 400) {
       let response;
       try {
-        response = eval("(" + this.responseText + ")");
+        const safeJson = self._unshieldResponseText(this.responseText);
+        response = eval("(" + safeJson + ")");
       } catch (e) {
         throw new Error("Failed to handle response: " + e.message + "\n" + this.responseText);
       }

package/src/core/Dialog.js

@@ -83,15 +83,17 @@ export default class Dialog {
     }).show();
   }
 
-  _fixBackdrop(content) {
+  _fixBackdrop() {
     const backdrops = document.querySelectorAll('.modal-backdrop');
+    let shown = false;
 
     backdrops.forEach((backdrop, index) => {
-      if (index > 0 && index === backdrops.length - 1) {
+      if (shown || index > 0 && index === backdrops.length - 1) {
         backdrop.style.display = 'none';
       } else {
         backdrop.style.zIndex = zIndex - 1;
         backdrop.style.display = '';
+        shown = true;
       }
     });
   }