Files
zulip-desktop/app/renderer/js/components/functional-tab.ts
Anders Kaseorg a9d59b3dcd CVE-2020-24582: Escape all strings interpolated into HTML.
Also fix various variable names to consistently indicate which strings
contain HTML.

Some of these changes close cross-site scripting vulnerabilities, and
others are for consistency.  It’s important to be meticulously
consistent about escaping so that changes that would introduce
vulnerabilities stand out as obviously wrong.

Signed-off-by: Anders Kaseorg <anders@zulip.com>
2020-09-04 22:52:38 -07:00

52 lines
1.2 KiB
TypeScript

import {htmlEscape} from 'escape-goat';
import Tab, {TabProps} from './tab';
export default class FunctionalTab extends Tab {
$closeButton: Element;
constructor(props: TabProps) {
super(props);
this.init();
}
templateHTML(): string {
return htmlEscape`
<div class="tab functional-tab" data-tab-id="${this.props.tabIndex}">
<div class="server-tab-badge close-button">
<i class="material-icons">close</i>
</div>
<div class="server-tab">
<i class="material-icons">${this.props.materialIcon}</i>
</div>
</div>
`;
}
init(): void {
this.$el = this.generateNodeFromHTML(this.templateHTML());
if (this.props.name !== 'Settings') {
this.props.$root.append(this.$el);
this.$closeButton = this.$el.querySelectorAll('.server-tab-badge')[0];
this.registerListeners();
}
}
registerListeners(): void {
super.registerListeners();
this.$el.addEventListener('mouseover', () => {
this.$closeButton.classList.add('active');
});
this.$el.addEventListener('mouseout', () => {
this.$closeButton.classList.remove('active');
});
this.$closeButton.addEventListener('click', (event: Event) => {
this.props.onDestroy();
event.stopPropagation();
});
}
}