Visitar URL original
USWDS | xss audit, standardization by scottqueen-bixal · Pull Request #4329 · uswds/uswds · GitHub
Skip to content
Merged
Changes from 1 commit
Commits
Show all changes
34 commits
Select commit Hold shift + click to select a range
51e5e17
Merge branch 'develop' of github.com:uswds/uswds into develop
scottqueen-bixal Aug 13, 2021
b8c3e60
Merge branch 'develop' of github.com:uswds/uswds into develop
scottqueen-bixal Sep 3, 2021
0a258f3
clean up linting errors
scottqueen-bixal Sep 3, 2021
446e880
include no-unsanitized linter and rebuild modules
scottqueen-bixal Sep 3, 2021
60e4fb4
ignore rule for spec
scottqueen-bixal Sep 3, 2021
cda25da
clean up lint errors
scottqueen-bixal Sep 3, 2021
2ea0b2a
we use textContent instead of innerHtml
scottqueen-bixal Sep 3, 2021
dc268c9
we test for child node types on message
scottqueen-bixal Sep 3, 2021
7b81596
introduce sanitzer.js
scottqueen-bixal Sep 7, 2021
b700f4b
sanitize our html output
scottqueen-bixal Sep 7, 2021
5fdac9c
replace with textContent
scottqueen-bixal Sep 8, 2021
b79048c
properly build, sanitize and construct combobox to avoid xss vul
scottqueen-bixal Sep 20, 2021
59e3c14
moves svg template literal construct directly to innerHTML with Sanit…
scottqueen-bixal Sep 20, 2021
0431bc3
sanitize html
scottqueen-bixal Sep 21, 2021
fde5251
correct typo
scottqueen-bixal Sep 21, 2021
06e585d
replace missing id attribute
scottqueen-bixal Sep 21, 2021
b232ed6
recreate buttons
scottqueen-bixal Sep 21, 2021
06a8930
refactor listToGridHtml to create take in elements and create elements
scottqueen-bixal Sep 22, 2021
c720826
create date picker days elements
scottqueen-bixal Sep 22, 2021
28f56a9
create element based month picker
scottqueen-bixal Sep 22, 2021
3d5857d
build year table element
scottqueen-bixal Sep 23, 2021
8e9ce24
passing unit spec focus trap
scottqueen-bixal Sep 24, 2021
0bda4cb
build list items
scottqueen-bixal Sep 24, 2021
8eb0531
reset inner html when options length changes
scottqueen-bixal Sep 27, 2021
a2491f2
include tab focus with calendar date
scottqueen-bixal Sep 27, 2021
82f930c
includes test for text node
scottqueen-bixal Sep 30, 2021
9e316a4
autocomplete should be set to off
scottqueen-bixal Sep 30, 2021
877d98c
testing status innerHTML for node type
scottqueen-bixal Sep 30, 2021
1927acb
Adjust spacing.
Oct 4, 2021
2e19f8e
Run prettier on unit tests.
Oct 4, 2021
3e6828f
Run prettier on component js.
Oct 4, 2021
07f9573
confirms aria-label returns as string
scottqueen-bixal Oct 4, 2021
37bce34
Merge branch 'gsq-xss-audit' of github.com:uswds/uswds into gsq-xss-a…
scottqueen-bixal Oct 4, 2021
ff30ee4
Merge branch 'develop' of github.com:uswds/uswds into gsq-xss-audit
scottqueen-bixal Oct 12, 2021
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
build year table element
  • Loading branch information
scottqueen-bixal committed Sep 23, 2021
commit 3d5857d0dbde7e9419a933bc7d5fcc9b58a6d41d
138 changes: 92 additions & 46 deletions src/js/components/date-picker.js
Original file line number Diff line number Diff line change
Expand Up @@ -590,8 +590,6 @@ const listToGridHtml = (htmlArray, rowSize) => {
grid.push(tr);
}

// console.log("grid", grid)

return grid;
};

Expand Down Expand Up @@ -1474,56 +1472,104 @@ const displayYearSelection = (el, yearToDisplay) => {
classes.push(CALENDAR_YEAR_SELECTED_CLASS);
}

years.push(
`<button
type="button"
tabindex="${tabindex}"
class="${classes.join(" ")}"
data-value="${yearIndex}"
aria-selected="${isSelected ? "true" : "false"}"
${isDisabled ? `disabled="disabled"` : ""}
>${yearIndex}</button>`
);
const btn = document.createElement("button");
btn.setAttribute("type", "button");
btn.setAttribute("tabindex", tabindex);
btn.setAttribute("class", classes.join(" "));
btn.setAttribute("data-value", yearIndex);
btn.setAttribute("aria-selected", isSelected ? "true" : "false");
if (isDisabled === true) {
btn.disabled = true;
}
btn.textContent = yearIndex;

years.push(btn);
yearIndex += 1;
}

const yearsHtml = listToGridHtml(years, 3);

const newCalendar = calendarEl.cloneNode();
newCalendar.innerHTML = `<div tabindex="-1" class="${CALENDAR_YEAR_PICKER_CLASS}">
<table class="${CALENDAR_TABLE_CLASS}" role="presentation">
<tbody>
<tr>
<td>
<button
type="button"
class="${CALENDAR_PREVIOUS_YEAR_CHUNK_CLASS}"
aria-label="Navigate back ${YEAR_CHUNK} years"
${prevYearChunkDisabled ? `disabled="disabled"` : ""}
>&nbsp;</button>
</td>
<td colspan="3">
<table class="${CALENDAR_TABLE_CLASS}" role="presentation">
<tbody>
${yearsHtml}
</tbody>
</table>
</td>
<td>
<button
type="button"
class="${CALENDAR_NEXT_YEAR_CHUNK_CLASS}"
aria-label="Navigate forward ${YEAR_CHUNK} years"
${nextYearChunkDisabled ? `disabled="disabled"` : ""}
>&nbsp;</button>
</td>
</tr>
</tbody>
</table>
</div>`;

// create the years calendar wrapper
const yearsCalendarWrapper = document.createElement("div")
yearsCalendarWrapper.setAttribute("tabindex", "-1");
yearsCalendarWrapper.setAttribute("class", CALENDAR_YEAR_PICKER_CLASS);

// create table parent
const yearsTableParent = document.createElement("table");
yearsTableParent.setAttribute("role", "presentation");
yearsTableParent.setAttribute("class", CALENDAR_TABLE_CLASS);

// create table body and table row
const yearsHTMLTableBody = document.createElement("tbody");
const yearsHTMLTableBodyRow = document.createElement("tr");


// create previous button
const previousYearsBtn = document.createElement("button");
previousYearsBtn.setAttribute("type", "button");
previousYearsBtn.setAttribute("class", CALENDAR_PREVIOUS_YEAR_CHUNK_CLASS);
previousYearsBtn.setAttribute("aria-label", `Navigate back ${YEAR_CHUNK} years`);
if (prevYearChunkDisabled === true) {
previousYearsBtn.disabled = true;
}
previousYearsBtn.innerHTML = Sanitizer.escapeHTML`&nbsp`

// create next button
const nextYearsBtn = document.createElement("button");
nextYearsBtn.setAttribute("type", "button");
nextYearsBtn.setAttribute("class", CALENDAR_NEXT_YEAR_CHUNK_CLASS);
nextYearsBtn.setAttribute("aria-label", `Navigate forward ${YEAR_CHUNK} years`);
if (nextYearChunkDisabled === true) {
nextYearsBtn.disabled = true;
}
nextYearsBtn.innerHTML = Sanitizer.escapeHTML`&nbsp`

// create the actual years table
const yearsTable = document.createElement("table")
yearsTable.setAttribute("class", CALENDAR_TABLE_CLASS);
yearsTable.setAttribute("role", "presentation");

// create the years child table
const yearsGrid = listToGridHtml(years, 3);
const yearsTableBody = createTableBody(yearsGrid);

// append the grid to the years child table
yearsTable.insertAdjacentElement("beforeend", yearsTableBody);

// create the prev button td and append the prev button
const yearsHTMLTableBodyDetailPrev = document.createElement("td");
yearsHTMLTableBodyDetailPrev.insertAdjacentElement("beforeend", previousYearsBtn);

// create the years td and append the years child table
const yearsHTMLTableBodyYearsDetail = document.createElement("td");
yearsHTMLTableBodyYearsDetail.setAttribute("colspan", "3");
yearsHTMLTableBodyYearsDetail.insertAdjacentElement("beforeend", yearsTable)

// create the next button td and append the next button
const yearsHTMLTableBodyDetailNext = document.createElement("td")
yearsHTMLTableBodyDetailNext.insertAdjacentElement("beforeend", nextYearsBtn)

// append the three td to the years child table row
yearsHTMLTableBodyRow.insertAdjacentElement("beforeend", yearsHTMLTableBodyDetailPrev)
yearsHTMLTableBodyRow.insertAdjacentElement("beforeend", yearsHTMLTableBodyYearsDetail)
yearsHTMLTableBodyRow.insertAdjacentElement("beforeend", yearsHTMLTableBodyDetailNext)

// append the table row to the years child table body
yearsHTMLTableBody.insertAdjacentElement("beforeend", yearsHTMLTableBodyRow)

// append the years table body to the years parent table
yearsTableParent.insertAdjacentElement("beforeend", yearsHTMLTableBody)

// append the parent table to the calendar wrapper
yearsCalendarWrapper.insertAdjacentElement("beforeend", yearsTableParent)

// append the years calnder to the new calendar
newCalendar.insertAdjacentElement("beforeend", yearsCalendarWrapper)

// replace calendar
calendarEl.parentNode.replaceChild(newCalendar, calendarEl);

statusEl.textContent = `Showing years ${yearToChunk} to ${
statusEl.textContent = Sanitizer.escapeHTML`Showing years ${yearToChunk} to ${
yearToChunk + YEAR_CHUNK - 1
}. Select a year.`;

Expand Down