docs: enforce alphanumeric strings for video id to prevent XSS (432fbcc5) · Commits · e / os / android_frameworks_base

docs/html/videos/index.jd

+33 −16

Original line number	Original line	Diff line number	Diff line
	@@ -62,7 +62,7 @@ $(window).history(function(e, hash) {
	*/		*/
	function loadVideo(id, title, autoplay) {		function loadVideo(id, title, autoplay) {
	if($("." + id).hasClass("noplay")) {		if($("." + id).hasClass("noplay")) {
	console.log("noplay");		//console.log("noplay");
	autoplay = false;		autoplay = false;
	$("." + id).removeClass("noplay");		$("." + id).removeClass("noplay");
	}		}
	@@ -255,6 +255,11 @@ var clickVideoAttempts = 0; // Used with clickVideo()
	* @param videoId The ID of the video to click		* @param videoId The ID of the video to click
	*/		*/
	function clickVideo(videoId) {		function clickVideo(videoId) {
			if (!isAlphaNumeric(videoId)) {
			clickDefaultVideo();
			return;
			}

	if ($("." + videoId).length != 0) { // if we find the video, click it and return		if ($("." + videoId).length != 0) { // if we find the video, click it and return
	$("." + videoId).addClass("noplay"); // add class to indicate we should NOT autoplay (class removed by loadVideo)		$("." + videoId).addClass("noplay"); // add class to indicate we should NOT autoplay (class removed by loadVideo)
	$("." + videoId + ":first").click();		$("." + videoId + ":first").click();
	@@ -274,6 +279,18 @@ function clickVideo(videoId) {
	}		}
	}		}

			/* returns true if the provided text is alphanumeric, false otherwise
			TODO: move this to the dev site js library */
			function isAlphaNumeric(text){
			var regex=/^[0-9A-Za-z]+$/; //^[a-zA-z]+$/
			if(regex.test(text)){
			return true;
			} else {
			console.log("Bogus video ID");
			return false;
			}
			}

	/* Click the default video that should be loaded on page load (the first video in the featured list) */		/* Click the default video that should be loaded on page load (the first video in the featured list) */
	function clickDefaultVideo() {		function clickDefaultVideo() {
	if ($("#mainBodyRight .videoPreviews a:first").length != 0) {		if ($("#mainBodyRight .videoPreviews a:first").length != 0) {