#2985 Prevent XSS for REST API by escape String content:

- Fixed create Data Source in new UI; - Fixed update Meta Data Point in new UI;
SCADA-LTS · Nov 25, 2024 · 78fb45f · 78fb45f
1 parent ac79f82
commit 78fb45f
Show file tree

Hide file tree

Showing 5 changed files with 27 additions and 29 deletions.
diff --git a/scadalts-ui/src/components/datasources/DataSourceConfig.vue b/scadalts-ui/src/components/datasources/DataSourceConfig.vue
@@ -125,10 +125,9 @@ export default {
 	mounted() {
 		if (this.creator) {
 			this.$store.dispatch('getUniqueDataSourceXid').then((resp) => {
-				this.datasource.xid = resp;
 				this.datasource.tempXid = resp;
+				this.datasource = JSON.parse(JSON.stringify(this.datasource));
 			});
-			this.datasource.tempName = this.datasource.name;
 		} else {
             this.datasource.tempName = this.datasource.name;
             this.datasource.tempXid = this.datasource.xid;
@@ -176,7 +175,7 @@ export default {
 			} catch (e) {
 				console.error('Failed to fetch data');
 			}
-		},
+		}
 	},
 };
 </script>
diff --git a/scadalts-ui/src/components/datasources/DataSourceConfigMixin.js b/scadalts-ui/src/components/datasources/DataSourceConfigMixin.js
@@ -60,7 +60,8 @@ export const dataSourceConfigMixin = {
         generateUniqueXid() {
             if (this.createMode) {
                 this.$store.dispatch('getUniqueDataSourceXid').then(resp => {
-                    this.datasource.xid = resp;
+                    this.datasource.tempXid = resp;
+                    this.datasource = JSON.parse(JSON.stringify(this.datasource));
                 });
             }
         },

diff --git a/scadalts-ui/src/components/datasources/MetaDataSource/point.vue b/scadalts-ui/src/components/datasources/MetaDataSource/point.vue
@@ -5,7 +5,7 @@
 			:creator="createMode"
 			:datapoint="datapoint"
 			@cancel="cancel()"
-			@accept="save()"
+			@accept="save"
 		>
 			<template v-slot:selector>
 				<v-select

diff --git a/scadalts-ui/src/components/datasources/VirtualDataSource/point.vue b/scadalts-ui/src/components/datasources/VirtualDataSource/point.vue
@@ -38,7 +38,7 @@
 								label="Start Value"
 								v-model="datapoint.pointLocator.alternateBooleanChange.startValue"
 								:items="booleanSelectBox"
-                                :rules = "[ruleNotNull]"
+                                :rules = "ruleNotNull"
 							></v-select>
 						</v-col>
 					</v-row>
@@ -50,7 +50,7 @@
 								label="Start Value"
 								v-model="datapoint.pointLocator.randomBooleanChange.startValue"
 								:items="booleanSelectBox"
-                                :rules = "[ruleNotNull]"
+                                :rules = "ruleNotNull"
 							></v-select>
 						</v-col>
 					</v-row>
@@ -60,7 +60,7 @@
 								label="Start Value"
 								v-model="datapoint.pointLocator.noChange.startValue"
 								:items="booleanSelectBox"
-                                :rules = "[ruleNotNull]"
+                                :rules = "ruleNotNull"
                                 required
 							></v-select>
 						</v-col>
@@ -97,7 +97,7 @@
 								label="Initail Value"
 								v-model="datapoint.pointLocator.incrementMultistateChange.startValue"
 								:items="datapoint.pointLocator.incrementMultistateChange.values"
-                                :rules="[ruleNotNull]"
+                                :rules="ruleNotNull"
 							></v-select>
 						</v-col>
 						<v-col
@@ -145,7 +145,7 @@
 								label="Initail Value"
 								v-model="datapoint.pointLocator.randomMultistateChange.startValue"
 								:items="datapoint.pointLocator.randomMultistateChange.values"
-                                :rules="[ruleNotNull]"
+                                :rules="ruleNotNull"
 							></v-select>
 						</v-col>
 						<v-col
@@ -171,7 +171,7 @@
 								label="Start Value"
 								type="number"
 								v-model="datapoint.pointLocator.noChange.startValue"
-                                :rules="[ruleNotNull]"
+                                :rules="ruleNotNull"
 							></v-text-field>
 						</v-col>
 					</v-row>
@@ -194,23 +194,23 @@
 								type="Number"
 								label="Maximum"
 								v-model="datapoint.pointLocator.brownianChange.max"
-                                :rules="[ruleNotNull]"
+                                :rules="ruleNotNull"
 							></v-text-field>
 						</v-col>
 						<v-col>
 							<v-text-field
 								type="Number"
 								label="Maximum Change"
 								v-model="datapoint.pointLocator.brownianChange.maxChange"
-                                :rules="[ruleNotNull]"
+                                :rules="ruleNotNull"
 							></v-text-field>
 						</v-col>
 						<v-col>
 							<v-text-field
 								type="Number"
 								label="Start value"
 								v-model="datapoint.pointLocator.brownianChange.startValue"
-                                :rules="[ruleNotNull]"
+                                :rules="ruleNotNull"
 							></v-text-field>
 						</v-col>
 					</v-row>
@@ -232,15 +232,15 @@
 								type="Number"
 								label="Maximum"
 								v-model="datapoint.pointLocator.incrementAnalogChange.max"
-                                :rules="[ruleNotNull]"
+                                :rules="ruleNotNull"
 							></v-text-field>
 						</v-col>
 						<v-col>
 							<v-text-field
 								type="Number"
 								label="Maximum Change"
 								v-model="datapoint.pointLocator.incrementAnalogChange.change"
-                                :rules="[ruleNotNull]"
+                                :rules="ruleNotNull"
 							></v-text-field>
 						</v-col>
 						<v-col>
@@ -254,7 +254,7 @@
 								type="Number"
 								label="Start value"
 								v-model="datapoint.pointLocator.incrementAnalogChange.startValue"
-                                :rules="[ruleNotNull]"
+                                :rules="ruleNotNull"
 							></v-text-field>
 						</v-col>
 					</v-row>
@@ -265,7 +265,7 @@
 								type="Number"
 								label="Start value"
 								v-model="datapoint.pointLocator.noChange.startValue"
-                                :rules="[ruleNotNull]"
+                                :rules="ruleNotNull"
 							></v-text-field>
 						</v-col>
 					</v-row>
@@ -292,7 +292,7 @@
 								type="Number"
 								label="Start value"
 								v-model="datapoint.pointLocator.randomAnalogChange.startValue"
-								:rules="[ruleNotNull]"
+								:rules="ruleNotNull"
 							></v-text-field>
 							<!-- TODO: Add rule for not null -->
 						</v-col>
@@ -309,31 +309,31 @@
 								type="Number"
 								label="Attraction Point ID"
 								v-model="datapoint.pointLocator.analogAttractorChange.attractionPointId"
-                                :rules="[ruleNotNull]"
+                                :rules="ruleNotNull"
 							></v-text-field>
 						</v-col>
 						<v-col>
 							<v-text-field
 								type="Number"
 								label="volatility"
 								v-model="datapoint.pointLocator.analogAttractorChange.volatility"
-                                :rules="[ruleNotNull]"
+                                :rules="ruleNotNull"
 							></v-text-field>
 						</v-col>
 						<v-col>
 							<v-text-field
 								type="Number"
 								label="maxChange"
 								v-model="datapoint.pointLocator.analogAttractorChange.maxChange"
-                                :rules="[ruleNotNull]"
+                                :rules="ruleNotNull"
 							></v-text-field>
 						</v-col>
 						<v-col>
 							<v-text-field
 								type="Number"
 								label="Start value"
 								v-model="datapoint.pointLocator.analogAttractorChange.startValue"
-                                :rules="[ruleNotNull]"
+                                :rules="ruleNotNull"
 							></v-text-field>
 						</v-col>
 					</v-row>
@@ -346,7 +346,7 @@
 					<v-text-field
 						label="Initial Value"
 						v-model="datapoint.pointLocator.noChange.startValue"
-                        :rules="[ruleNotNull]"
+                        :rules="ruleNotNull"
 					></v-text-field>
 				</v-col>
 			</v-row>

diff --git a/scadalts-ui/src/views/Reports/ReportsForm.vue b/scadalts-ui/src/views/Reports/ReportsForm.vue
@@ -321,7 +321,7 @@
 							<v-text-field
 								v-model="email"
 								label="Add email address"
-								:rules="[emailRules, xssRules]"
+								:rules="emailRules"
 							>
 							   <template slot="append-outer">
                                  <v-icon v-if="validEmail" color="green darken-2" @click="addMail" >mdi-plus</v-icon>
@@ -395,10 +395,8 @@ export default {
 			],
 			emailRules: [
 				v =>  /\S+@\S+\.\S+/.test(v) || this.$t('reports.emailMustBeValid'),
+				v => !(/^(.*?((expression\s*\()|url\s*\(\s*['\"]?javascript:|url\s*\(\s*['\"]?data:|<script[^>]*>|<\/script>|<img[^>]+onerror=|@import\s+url\s*\(\s*['\"]?javascript:|<img[^>]*>|<script[^>]*>|<[^>]+>onerror\s*=|onload\s*=|eval\s*\(|alert\s*\(|onerror\s*=|document.location){1}.*?)$/.test(v)) || this.$t('reports.emailMustBeValid')
 			],
-            xssRules: [
-                v => !(/^(.*?((expression\s*\()|url\s*\(\s*['\"]?javascript:|url\s*\(\s*['\"]?data:|<script[^>]*>|<\/script>|<img[^>]+onerror=|@import\s+url\s*\(\s*['\"]?javascript:|<img[^>]*>|<script[^>]*>|<[^>]+>onerror\s*=|onload\s*=|eval\s*\(|alert\s*\(|onerror\s*=|document.location){1}.*?)$/.test(v)) || this.$t('reports.emailMustBeValid')
-            ],
 
 			userList: [],
 			recipientList: [],
@@ -625,7 +623,7 @@ export default {
             if(!v) {
                 return false;
             }
-            return !(typeof this.emailRules[0](v) === 'string') && !(typeof this.xssRules[0](v) === 'string');
+            return !(typeof this.emailRules[0](v) === 'string') && !(typeof this.emailRules[1](v) === 'string');
         }
 	}
 }