Commit fa656935 authored by JC Brand's avatar JC Brand

Don't use `_.template` for variable interpolation

It depends on `eval` which is unsafe.
parent 4d34952e
# Changelog # Changelog
## 3.3.4 (Unreleased)
- Avoid `eval` (via `_.template` from lodash).
## 3.3.3 (2018-02-14) ## 3.3.3 (2018-02-14)
### Bugfixes ### Bugfixes
......
...@@ -1862,7 +1862,7 @@ ...@@ -1862,7 +1862,7 @@
i18n.fetchTranslations( i18n.fetchTranslations(
_converse.locale, _converse.locale,
_converse.locales, _converse.locales,
_.template(_converse.locales_url)({'locale': _converse.locale})) u.interpolate(_converse.locales_url, {'locale': _converse.locale}))
.catch(_.partial(_converse.log, _, Strophe.LogLevel.FATAL)) .catch(_.partial(_converse.log, _, Strophe.LogLevel.FATAL))
.then(finishInitialization) .then(finishInitialization)
.catch(_.partial(_converse.log, _, Strophe.LogLevel.FATAL)); .catch(_.partial(_converse.log, _, Strophe.LogLevel.FATAL));
......
...@@ -646,6 +646,14 @@ ...@@ -646,6 +646,14 @@
return promise; return promise;
}; };
u.interpolate = function (string, o) {
return string.replace(/{{{([^{}]*)}}}/g,
(a, b) => {
var r = o[b];
return typeof r === 'string' || typeof r === 'number' ? r : a;
});
};
u.safeSave = function (model, attributes) { u.safeSave = function (model, attributes) {
if (u.isPersistableModel(model)) { if (u.isPersistableModel(model)) {
model.save(attributes); model.save(attributes);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment