diff --git a/Frontend/assets/scripts/tools/scripts.js b/Frontend/assets/scripts/tools/scripts.js index 6397da3..5e1438e 100644 --- a/Frontend/assets/scripts/tools/scripts.js +++ b/Frontend/assets/scripts/tools/scripts.js @@ -53,7 +53,7 @@ function getVersion() { * @kind function */ function clearDataField() { - document.getElementById("xmlArea").value = ""; + document.getElementById("xmlArea").innerHTML = ""; document.getElementById("xmlArea").style.color = null; document.getElementById("xmlArea").style.backgroundColor = null; @@ -62,6 +62,27 @@ function clearDataField() { document.getElementById("transformArea").style.backgroundColor = null; } + +/** + * The `escapeHTML` function is used to escape special characters in an HTML element's innerHTML property. + * This is done to prevent these characters from being interpreted as HTML tags or attributes, + * which could potentially cause security vulnerabilities or unintended behavior. + * + * @function + * @name escapeHTML + * @kind function + * @param {any} element + * @returns {void} + */ +function escapeHTML(element) { + element.innerHTML = element.innerHTML + .replace(/&/g, "&") + .replace(//g, ">") + .replace(/"/g, """) + .replace(/'/g, "'"); +} + /** * It fills the XML area with a sample XML. * @@ -78,8 +99,10 @@ function fillDefaultXML(element) { fetch(serverAddress + "/assets/samples/sampleXml.xml") .then(response => response.text()) .then((exampleData) => { - document.getElementById("xmlArea").value = exampleData; + document.getElementById("xmlArea").innerHTML = exampleData; + escapeHTML(document.getElementById("xmlArea")); document.getElementById("xmlArea").style.backgroundColor = null; + hljs.highlightAll(); }) } } diff --git a/Frontend/tools/xpath.html b/Frontend/tools/xpath.html index c89e429..8eeec3f 100644 --- a/Frontend/tools/xpath.html +++ b/Frontend/tools/xpath.html @@ -53,9 +53,7 @@ class="textarea-300 bordered-field vertically-resizeable max-width" onblur="setDefaultContent(this, 'Insert XML here');" onfocus="clearDefaultContent(this, 'Insert XML here');"> --> -
-                        Insert XML here
-                    
+