Skip to content

Fix strikes page JavaScript errors #70

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Apr 22, 2025
Merged

Fix strikes page JavaScript errors #70

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
147 changes: 73 additions & 74 deletions src/Strikes/my-strikes.html
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,16 +9,17 @@
font-family: Sans-Serif;
margin: 0;
}
<link href='https://fonts.googleapis.com/css?family=Comfortaa' rel='stylesheet'>
<style>
body {
font-family: 'Comfortaa';font-size: 22px;
}

.dynamic-content {
display:none;
}

</style>
<link href='https://fonts.googleapis.com/css?family=Comfortaa' rel='stylesheet'>
<style>
body {
font-family: 'Comfortaa';font-size: 22px;
}

.dynamic-content {
display:none;
}

.menu-container {
position: relative;
display: flex;
Expand Down Expand Up @@ -107,6 +108,7 @@
}
}
</style>
<script src="//code.jquery.com/jquery-1.12.0.min.js"></script>

Check warning

Code scanning / CodeQL

Inclusion of functionality from an untrusted source Medium

Script loaded from content delivery network with no integrity check.
</head>
<body>
<nav class="menu-container">
Expand All @@ -133,75 +135,72 @@
</div>
</nav>

<!-- This is the staff profile system -->
<h1>Staff Profile</h1>

<!-- Default Dynamic Section -->
<div id="default-content" class="dynamic-content">
<h2>No Strike ID</h2>
Make sure you got a vaild link and come back. You may also not have any strikes at this time. If that's true, keep up the good work!
</div>
<!-- Dynamic Section 1 -->
<div id="username1" class="dynamic-content">
<h2>Username 1</h2>
<h3>1 Strike</h3>
<br>
Oops! You currently have 1 Strike at Coding Hut. Look below to see your strikes.
</div>
<!-- Dynamic Section 2 -->
<div id="staff2" class="dynamic-content">
<h2>Staff2</h2>
<br>
DESCRIPTION HERE
</div>
<!-- Dynamic Section 3 -->
<div id="staff3" class="dynamic-content">
<h2>Staff3</h2>
<br>
DESCRIPTION HERE
</div>
<!-- This is the strikes information system -->
<h1>My Strikes</h1>

<!-- Default Dynamic Section -->
<div id="default-content" class="dynamic-content">
<h2>No Strike ID</h2>
Make sure you got a valid link and come back. You may also not have any strikes at this time. If that's true, keep up the good work!
</div>
<!-- Dynamic Section 1 -->
<div id="username1" class="dynamic-content">
<h2>Username 1</h2>
<h3>1 Strike</h3>
<br>
Oops! You currently have 1 Strike at Coding Hut. Look below to see your strikes.
</div>
<!-- Dynamic Section 2 -->
<div id="staff2" class="dynamic-content">
<h2>Staff2</h2>
<br>
DESCRIPTION HERE
</div>
<!-- Dynamic Section 3 -->
<div id="staff3" class="dynamic-content">
<h2>Staff3</h2>
<br>
DESCRIPTION HERE
</div>
<script>
function toggleMenu() {
var menu = document.querySelector('.menu');
menu.style.display = menu.style.display === 'flex' ? 'none' : 'flex';
}

// Parse the URL parameter
function getParameterByName(name, url) {
if (!url) url = window.location.href;
name = name.replace(/[\[\]]/g, "\\$&");

Check failure

Code scanning / CodeQL

Incomplete string escaping or encoding High

This does not escape backslash characters in the input.

Copilot Autofix

AI about 1 month ago

To fix the issue, we need to ensure that backslashes in the name parameter are properly escaped before constructing the regular expression. This can be achieved by adding an additional replace call to escape backslashes (\) in the input string. Specifically:

  1. Add a replace call to escape backslashes before escaping square brackets.
  2. Use a well-tested approach to escape backslashes by replacing each backslash with a double backslash (\\).

The updated code will ensure that both backslashes and square brackets are properly escaped, making the function robust against malformed or insecure regular expressions.

Suggested changeset 1
src/Strikes/my-strikes.html

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/src/Strikes/my-strikes.html b/src/Strikes/my-strikes.html
--- a/src/Strikes/my-strikes.html
+++ b/src/Strikes/my-strikes.html
@@ -174,3 +174,3 @@
         if (!url) url = window.location.href;
-        name = name.replace(/[\[\]]/g, "\\$&");
+        name = name.replace(/\\/g, "\\\\").replace(/[\[\]]/g, "\\$&");
         var regex = new RegExp("[?&]" + name + "(=([^&#]*)|&|#|$)"),
EOF
@@ -174,3 +174,3 @@
if (!url) url = window.location.href;
name = name.replace(/[\[\]]/g, "\\$&");
name = name.replace(/\\/g, "\\\\").replace(/[\[\]]/g, "\\$&");
var regex = new RegExp("[?&]" + name + "(=([^&#]*)|&|#|$)"),
Copilot is powered by AI and may make mistakes. Always verify output.
var regex = new RegExp("[?&]" + name + "(=([^&#]*)|&|#|$)"),
results = regex.exec(url);
if (!results) return null;
if (!results[2]) return '';
return decodeURIComponent(results[2].replace(/\+/g, " "));
}

$(document).ready(function() {
// Give the parameter a variable name
var dynamicContent = getParameterByName('strikeid');

// Check if the URL parameter matches any of our dynamic sections
if (dynamicContent == 'username1') {
$('#username1').show();
}
// Check if the URL parameter is staff2
else if (dynamicContent == 'staff2') {
$('#staff2').show();
}
// Check if the URL parameter is staff3
else if (dynamicContent == 'staff3') {
$('#staff3').show();
}
// Check if the URL parameter is empty or not defined, display default content
else {
$('#default-content').show();
}
});
</script>
</body>
</html>

<script src="//code.jquery.com/jquery-1.12.0.min.js"></script>
<script type="text/javascript">
// Parse the URL parameter
function getParameterByName(name, url) {
if (!url) url = window.location.href;
name = name.replace(/[\[\]]/g, "\\$&");
var regex = new RegExp("[?&]" + name + "(=([^&#]*)|&|#|$)"),
results = regex.exec(url);
if (!results) return null;
if (!results[2]) return '';
return decodeURIComponent(results[2].replace(/\+/g, " "));
}
// Give the parameter a variable name
var dynamicContent = getParameterByName('strikeid');

$(document).ready(function() {

// Check if the URL parameter is apples
if (dynamicContent == 'myscratchedaccount') {
$('#myscratchedaccount').show();
}
// Check if the URL parameter is oranges
else if (dynamicContent == 'staff2') {
$('#staff2').show();
}
// Check if the URL parameter is bananas
else if (dynamicContent == 'staff3') {
$('#staff3').show();
}
// Check if the URL parmeter is empty or not defined, display default content
else {
$('#default-content').show();
}
});
</script>