client hardening
This commit is contained in:
		
							
								
								
									
										14
									
								
								main.js
									
									
									
									
									
								
							
							
						
						
									
										14
									
								
								main.js
									
									
									
									
									
								
							| @ -79,7 +79,6 @@ logged_in = false; | ||||
| var connection = null; | ||||
| var session_id = null; | ||||
|  | ||||
|  | ||||
| // cookies: | ||||
| function get_cookie(cname) { | ||||
|     var name = cname + "="; | ||||
| @ -113,16 +112,16 @@ function check_cookie(cname) { | ||||
|  | ||||
| status_message = function(text, blink = true) | ||||
| { | ||||
|     l_status.innerHTML = text; | ||||
|     l_status.innerHTML = encodeHTML(text); | ||||
|     if (blink) | ||||
|     { | ||||
|         status_container.blink("rgba(126,87,194, 0.5)"); | ||||
|         status_container.blink(theme_color_highlight); | ||||
|     } | ||||
| } | ||||
|  | ||||
| status_error = function(text, blink=true) | ||||
| { | ||||
|     l_status.innerHTML = text; | ||||
|     l_status.innerHTML = encodeHTML(text); | ||||
|     if (blink) | ||||
|     { | ||||
|         status_container.blink("rgba(128,0,0,0.5"); | ||||
| @ -131,7 +130,8 @@ status_error = function(text, blink=true) | ||||
|  | ||||
|  | ||||
|  | ||||
| status_message("select gamemode. click <br> <a href=https://en.wikipedia.org/wiki/Ultimate_tic-tac-toe#Rules>[here]</a> for the rules!"); | ||||
| l_status.innerHTML = "select gamemode. click <br> <a href=https://en.wikipedia.org/wiki/Ultimate_tic-tac-toe#Rules>[here]</a> for the rules!"; | ||||
| status_container.blink(theme_color_highlight); | ||||
|  | ||||
|  | ||||
| // global funcs: | ||||
| @ -213,7 +213,7 @@ login_callback = function() | ||||
|          | ||||
|     } | ||||
|     end_local_game(); | ||||
|     logout_container.update_head("logged in as: " + connection.player.get_name()); | ||||
|     logout_container.update_head("logged in as: " + encodeHTML(connection.player.get_name())); | ||||
|     //logout_container.blink("rgba(128,128,128,0.5)"); | ||||
|  | ||||
|     set_cookie("sessionid", connection.session_id, 30); | ||||
| @ -314,7 +314,7 @@ show_highscores = function() | ||||
|                 { | ||||
|                     name=name.substring(0,10) + "…"; | ||||
|                 } | ||||
|                 new_text += "\#" + (i+1) + ": " + name + " [" + connection.top_elos[i] + "]<br>"; | ||||
|                 new_text += "\#" + (i+1) + ": " + " [" + encodeHTML("" + connection.top_elos[i]) + "]" + encodeHTML(name) + "<br>"; | ||||
|             } | ||||
|  | ||||
|             l_highscores.innerHTML = new_text; | ||||
|  | ||||
| @ -64,7 +64,7 @@ class OnlineMatchManager | ||||
|  | ||||
|         this.game_server_connection.send_move(sub_x, sub_y, x, y, this.match_id); | ||||
|  | ||||
|         this.info_func("waiting for " + this.online_opponent.get_name() + "'s move", false); | ||||
|         this.info_func("waiting for " + encodeHTML(this.online_opponent.get_name()) + "'s move", false); | ||||
|     } | ||||
|  | ||||
|     on_user_close() | ||||
| @ -113,7 +113,7 @@ class OnlineMatchManager | ||||
|  | ||||
|         if (this.match_state.active_player == this.local_player.get_name()) | ||||
|         { | ||||
|             this.game_server_connection.notify("your turn against " + this.online_opponent.get_name()); | ||||
|             this.game_server_connection.notify("your turn against " + encodeHTML(this.online_opponent.get_name())); | ||||
|         } | ||||
|     } | ||||
|  | ||||
| @ -214,9 +214,6 @@ class OnlineMatchManager | ||||
|         var player_a = this.match_state.player_a; | ||||
|         var player_b = this.match_state.player_b; | ||||
|  | ||||
|         console.log(game_over); | ||||
|         console.log(current_player); | ||||
|  | ||||
|         var FIELD_EMPTY = 0 | ||||
|         var FIELD_USER = player_a == this.player_name ? 1 : 2; | ||||
|         var FIELD_OPPONENT = player_a == this.player_name ? 2 : 1; | ||||
| @ -318,13 +315,13 @@ class OnlineMatchManager | ||||
|         } | ||||
|         else | ||||
|         { | ||||
|             this.info_func("waiting for " + this.online_opponent.get_name() + "'s move", false); | ||||
|             this.info_func("waiting for " + encodeHTML(this.online_opponent.get_name()) + "'s move", false); | ||||
|             this.control_container.blink(theme_color_highlight); | ||||
|         } | ||||
|  | ||||
|         control_head += "" + current_player_name + "'s move"; | ||||
|  | ||||
|         this.control_container.update_head(control_head); | ||||
|         this.control_container.update_head(encodeHTML(control_head)); | ||||
|  | ||||
|          | ||||
|  | ||||
|  | ||||
							
								
								
									
										6
									
								
								tools.js
									
									
									
									
									
								
							
							
						
						
									
										6
									
								
								tools.js
									
									
									
									
									
								
							| @ -10,4 +10,10 @@ function clearInner(node) { | ||||
|     while (node.hasChildNodes()) { | ||||
|         clear(node.firstChild); | ||||
|     } | ||||
| } | ||||
|  | ||||
|  | ||||
| // encoding helper (found here: https://stackoverflow.com/a/2794366) | ||||
| function encodeHTML(s) { | ||||
|     return s.replace(/&/g, '&').replace(/</g, '<').replace(/"/g, '"'); | ||||
| } | ||||
| @ -258,7 +258,7 @@ class WebsocketConnection | ||||
|                     this.openmatches[id] = new OnlineMatchManager(this.grid, this.info_func, this.matches_container, this.control_container, this.end_button, this, id, match_state, this.player.get_name()); | ||||
|                     if (match_state.last_move == null) | ||||
|                     { | ||||
|                         this.notify("new Game against " + this.openmatches[id].online_opponent.get_name()); | ||||
|                         this.notify("new Game against " + encodeHTML(this.openmatches[id].online_opponent.get_name())); | ||||
|                     } | ||||
|                     this.matches_container.blink(theme_color_highlight); | ||||
|                 } | ||||
| @ -304,7 +304,7 @@ class WebsocketConnection | ||||
|         } | ||||
|         else | ||||
|         { | ||||
|             this.err_func("could not send request: " + data.msg); | ||||
|             this.err_func("could not send request: " + encodeHTML(data.msg)); | ||||
|         } | ||||
|     } | ||||
|  | ||||
| @ -356,7 +356,7 @@ class WebsocketConnection | ||||
|                 display_name = display_name.substr(0,8) + "…"; | ||||
|             }  | ||||
|  | ||||
|             var tmp = this.search_container.create_double_button("" + display_name + "<sup><span style=\"font-size: 0.5em\">" + this.elos[i] + "</span></sup>", "-"); | ||||
|             var tmp = this.search_container.create_double_button("" + encodeHTML(display_name) + "<sup><span style=\"font-size: 0.5em\">" + encodeHTML(""+this.elos[i]) + "</span></sup>", "-"); | ||||
|  | ||||
|             tmp[1].name = this.friends[i]; | ||||
|             tmp[2].name = this.friends[i]; | ||||
| @ -379,7 +379,7 @@ class WebsocketConnection | ||||
|     on_elo_update(data) | ||||
|     { | ||||
|         console.log("received elo update: " + data.elo); | ||||
|         this.logout_container.update_head("logged in as: " + connection.player.get_name() + "<br>Score: " + data.elo + "<br>Rank: " + data.rank); | ||||
|         this.logout_container.update_head("logged in as: " + encodeHTML(connection.player.get_name()) + "<br>Score: " + encodeHTML("" + data.elo) + "<br>Rank: " + encodeHTML(""+data.rank)); | ||||
|         this.top_names = data.top_names; | ||||
|         this.top_elos = data.top_elos; | ||||
|         this.logout_container.blink(theme_color_highlight); | ||||
|  | ||||
		Reference in New Issue
	
	Block a user