web-manager 3.2.63 → 3.2.65

package/lib/utilities.js

@@ -76,17 +76,32 @@ Utilities.set = function (obj, path, value) {
 // https://dzone.com/articles/cross-browser-javascript-copy-and-paste
 // https://hackernoon.com/copying-text-to-clipboard-with-javascript-df4d4988697f
 Utilities.clipboardCopy = function (input) {
-  var el = document.createElement('textarea');
-  el.setAttribute('style','width:1px;border:0;opacity:0;');
-  el.value = input && input.nodeType ? input.value || input.innerText || input.innerHTML : input;
-  document.body.appendChild(el);
-  el.select();
+  // Get the text from the input
+  var text = input && input.nodeType
+    ? input.value || input.innerText || input.innerHTML
+    : input;
+
+  // Try to use the modern clipboard API
   try {
-    document.execCommand('copy');
+    navigator.clipboard.writeText(text);
   } catch (e) {
-    alert('Please press Ctrl/Cmd+C to copy');
+    // Try creating a textarea and copying the text to it
+    var el = document.createElement('textarea');
+    el.setAttribute('style','width:1px;border:0;opacity:0;');
+    el.value = text;
+    document.body.appendChild(el);
+    el.select();
+
+    // Try to copy the text
+    try {
+      document.execCommand('copy');
+    } catch (e) {
+      alert('Please press Ctrl+C/Cmd+C to copy');
+    }
+
+    // Remove the textarea
+    document.body.removeChild(el);
   }
-  document.body.removeChild(el);
 }
 
 // Escape HTML
@@ -108,29 +123,19 @@ Utilities.clipboardCopy = function (input) {
 Utilities.escapeHTML = function (str) {
   shadow = shadow || document.createElement('p');
   shadow.innerHTML = '';
+
+  // This automatically escapes HTML entities like <, >, &, etc.
   shadow.appendChild(document.createTextNode(str));
 
-  return shadow.innerHTML
-    .replaceAll('&', '&amp;')
-    .replaceAll('<', '&lt;')
-    .replaceAll('>', '&gt;')
-    .replaceAll('"', '&quot;')
-    .replaceAll('\'', '&#039;');
-
-  // return shadow.innerHTML.replace(/[&<>"']/g, function (m) {
-  //   switch (m) {
-  //     case '&':
-  //       return '&amp;';
-  //     case '<':
-  //       return '&lt;';
-  //     case '>':
-  //       return '&gt;';
-  //     case '"':
-  //       return '&quot;';
-  //     case "'":
-  //       return '&#039;';
-  //   }
-  // });
+  // This is needed to escape quotes to prevent attribute injection
+  return shadow.innerHTML.replace(/["']/g, function(m) {
+    switch (m) {
+      case '"':
+        return '&quot;';
+      default:
+        return '&#039;';
+    }
+  });
 }
 
 Utilities.getContext = function () {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "web-manager",
-  "version": "3.2.63",
+  "version": "3.2.65",
   "description": "Easily access important variables such as the query string, current domain, and current page in a single object.",
   "main": "index.js",
   "scripts": {