Don't allow <script> tags in Hints Browser
@@ -335,7 +335,7 @@ implements IContextProvider, IHintsView, ISelectionListener, IComponentSelection
html.append("</head>"); //$NON-NLS-1$
html.append("<body>"); //$NON-NLS-1$
- html.append(text);
+ html.append(sanitiseBrowserText(text));
html.append("</body>"); //$NON-NLS-1$
html.append("</html>"); //$NON-NLS-1$
@@ -436,6 +436,12 @@ implements IContextProvider, IHintsView, ISelectionListener, IComponentSelection
return ColorFactory.get(220, 235, 235);
}
+ private String sanitiseBrowserText(String text) {
+ // Don't allow JS
+ text = text.replace("<script>", ""); //$NON-NLS-1$ //$NON-NLS-2$
+ text = text.replace("</script>", ""); //$NON-NLS-1$ //$NON-NLS-2$
+ return text;
+ }
@Override
public void dispose() {
