Browse Source

Add protection against malicious code in font loader.

Kalervo Kujala 13 years ago
parent
commit
ed2bcf0ffa
  1. 7
      src/fonts.js

7
src/fonts.js

@ -494,9 +494,14 @@ var FontLoader = { @@ -494,9 +494,14 @@ var FontLoader = {
// 82402.
// Validate the names parameter -- the values can used to construct HTML.
if (!/^\w+$/.test(names.join('')))
if (!/^\w+$/.test(names.join(''))) {
error('Invalid font name(s): ' + names.join());
// Normally the error-function throws. But if a malicious code
// intercepts the function call then the return is needed.
return;
}
var div = document.createElement('div');
div.setAttribute('style',
'visibility: hidden;' +

Loading…
Cancel
Save