Fix DOM text reinterpreted as HTML

sbrunner · sbrunner · commit 2ef083c2ae0d · 2024-09-17T16:59:56.000+02:00
See: https://github.com/camptocamp/ngeo/security/code-scanning/24 https://github.com/camptocamp/ngeo/security/code-scanning/25 https://github.com/camptocamp/ngeo/security/code-scanning/41
diff --git a/src/import/importdatasourceComponent.js b/src/import/importdatasourceComponent.js
@@ -254,7 +254,7 @@ export class Controller {
       if (this.file) {
         this.hasError = false;
         // update the label
-        $(fileInput).next('.custom-file-label').html(this.fileNameAndSize);
+        $(fileInput).next('.custom-file-label').text(this.fileNameAndSize);
       }
       this.scope_.$apply();
     });
diff --git a/src/mobile/navigation/component.js b/src/mobile/navigation/component.js
@@ -177,11 +177,12 @@ Controller.prototype.init = function (element) {
     if (!datatarget) {
       throw new Error('Missing datatarget');
     }
-    const slideIn = $(datatarget);
-    if (slideIn.length != 1) {
+    const slideInFound = $.find(datatarget);
+    if (slideInFound.length != 1) {
       throw new Error('Wrong slideIn');
     }
 
+    const slideIn = $(slideInFound);
     // slide the "new" element in
     slideIn.addClass(CLASS_NAMES.ACTIVE);
 

Original file line number	Diff line number	Diff line change
`@@ -254,7 +254,7 @@ export class Controller {`
`254`	`254`	`if (this.file) {`
`255`	`255`	`this.hasError = false;`
`256`	`256`	`// update the label`
`257`		`- $(fileInput).next('.custom-file-label').html(this.fileNameAndSize);`
	`257`	`+ $(fileInput).next('.custom-file-label').text(this.fileNameAndSize);`
`258`	`258`	`}`
`259`	`259`	`this.scope_.$apply();`
`260`	`260`	`});`
Original file line number	Diff line number	Diff line change
`@@ -177,11 +177,12 @@ Controller.prototype.init = function (element) {`
`177`	`177`	`if (!datatarget) {`
`178`	`178`	`throw new Error('Missing datatarget');`
`179`	`179`	`}`
`180`		`- const slideIn = $(datatarget);`
`181`		`- if (slideIn.length != 1) {`
	`180`	`+ const slideInFound = $.find(datatarget);`
	`181`	`+ if (slideInFound.length != 1) {`
`182`	`182`	`throw new Error('Wrong slideIn');`
`183`	`183`	`}`
`184`	`184`
	`185`	`+ const slideIn = $(slideInFound);`
`185`	`186`	`// slide the "new" element in`
`186`	`187`	`slideIn.addClass(CLASS_NAMES.ACTIVE);`
`187`	`188`