a53b9958fa734f73aeffb9ddfe2fbad1ca65f90c galt Mon Jan 30 16:18:41 2017 -0800 Check-in of CSP2 Content-Security-Policy work. All C-language CGIs should now support CSP2 in browser to stop major forms of XSS javascript injection. Javascript on pages is gathered together, and then emitted in a single script block at the end with a nonce that tells the browser, this is js that we generated instead of being injected by a hacker. Both inline script from script blocks and inline js event handlers had to be pulled out and separated. You will not see js sprinkled through-out the page now. Older browsers that support CSP1 or that do not understand CSP at all will still work, just without protection. External js libraries loaded at runtime need to be added to the CSP policy header in src/lib/htmshell.c. diff --git src/hg/inc/jsHelper.h src/hg/inc/jsHelper.h index 38c6943..bd8655d 100644 --- src/hg/inc/jsHelper.h +++ src/hg/inc/jsHelper.h @@ -1,183 +1,186 @@ // jsHelper.c - helper routines for interface between CGIs and client-side javascript /* Copyright (C) 2014 The Regents of the University of California * See README in this or parent directory for licensing information. */ #ifndef JSHELPER_H #define JSHELPER_H #include "cart.h" #include #include "jsonParse.h" #define JS_CLEAR_ALL_BUTTON_LABEL "Clear all" #define JS_SET_ALL_BUTTON_LABEL "Set all" #define JS_DEFAULTS_BUTTON_LABEL "Set defaults" // Make toggle and [+][-] buttons without image gifs. // Not ready for this release. //#define BUTTONS_BY_CSS void jsCreateHiddenForm(struct cart *cart, char *scriptName, char **vars, int varCount); /* Create a hidden form with the given variables. Must be * called. */ void jsInit(); /* If this is the first call, set window.onload to the operations * performed upon loading a page and print supporting javascript. * Currently this just sets the page vertical position if specified on * CGI, and includes jsHelper.js. * Subsequent calls do nothing, so this can be called many times. */ struct dyString *jsOnChangeStart(); /* Start up an onChange string */ char *jsOnChangeEnd(struct dyString **pDy); /* Finish up javascript onChange command. */ void jsDropDownCarryOver(struct dyString *dy, char *var); /* Add statement to carry-over drop-down item to dy. */ void jsTextCarryOver(struct dyString *dy, char *var); /* Add statement to carry-over text item to dy. */ void jsTrackingVar(char *jsVar, char *val); /* Emit a little Javascript to keep track of a variable. * This helps especially with radio buttons. */ void jsMakeTrackingRadioButton(char *cgiVar, char *jsVar, char *val, char *selVal); /* Make a radio button that also sets tracking variable * in javascript. */ void jsMakeTrackingRadioButtonExtraHtml(char *cgiVar, char *jsVar, char *val, char *selVal, char *extraHtml); /* Make a radio button with extra HTML attributes that also sets tracking variable * in javascript. */ void jsMakeTrackingCheckBox(struct cart *cart, char *cgiVar, char *jsVar, boolean usualVal); /* Make a check box filling in with existing value and * putting a javascript tracking variable on it. */ void jsTrackedVarCarryOver(struct dyString *dy, char *cgiVar, char *jsVar); /* Carry over tracked variable (radio button?) to hidden form. */ char *jsRadioUpdate(char *cgiVar, char *jsVar, char *val); /* Make a little javascript to check and uncheck radio buttons * according to new value. To use this you must have called * jsInit somewhere, and also must use jsMakeTrackingRadioButton * to make the buttons. */ char *jsSetVerticalPosition(char *form); /* Returns a javascript statement for storing the vertical position of the * page; typically this would go just before a document submit. * jsInit must be called first. * Do not free return value! */ void jsMakeCheckboxGroupSetClearButton(char *buttonVar, boolean isSet); /* Make a button for setting or clearing a set of checkboxes with the same name. * Uses only javascript to change the checkboxes, no resubmit. */ void jsMakeSetClearContainer(); /* Begin a wrapper div with class setClearContainer, plus 'Set all' and 'Clear all' buttons. * This should be followed by a bunch of checkboxes, and then a call to jsEndContainer. */ void jsEndContainer(); /* End a wrapper div. */ char *jsPressOnEnter(char *button); /* Returns a javascript statement that clicks button when the Enter key * has been pressed; typically this would go in a text input. * jsInit must be called first. * Do not free return value! */ void jsIncludeFile(char *fileName, char *noScriptMsg); /* Prints out html to include given javascript file from the js directory; suppresses redundant *