Potential fix for code scanning alert no. 18: Incomplete multi-character sanitization

Open-ILS/src/eg2/package.json

@@ -41,7 +41,8 @@
     "ngx-cookie": "^6.0.1",
     "rxjs": "^7.8.0",
     "ts-md5": "^1.3.1",
-    "zone.js": "^0.12.0"
+    "zone.js": "^0.12.0",
+    "sanitize-html": "^2.14.0"
   },
   "//": "NOTE: version of angular/cli should be kept in sync with Open-ILS/src/extras/install/Makefile.common",
   "devDependencies": {

Open-ILS/src/eg2/src/app/share/util/htmltotxt.service.ts

@@ -1,4 +1,5 @@
 import {Injectable} from '@angular/core';
+import sanitizeHtml from 'sanitize-html';
 
 const ENTITY_REGEX = /&[^\s]+;/;
 
@@ -10,11 +11,11 @@ const ENTITY_REGEX = /&[^\s]+;/;
 export class HtmlToTxtService {
 
     unEscapeHtml(text: string): string {
-        text = text.replace(/&/g, '&');
         text = text.replace(/"/g, '"');
         text = text.replace(/ /g, ' ');
         text = text.replace(/&lt;/g, '<');
         text = text.replace(/&gt;/g, '>');
+        text = text.replace(/&amp;/g, '&');
         return text;
     }
 
@@ -42,7 +43,11 @@ export class HtmlToTxtService {
         //       but as of 2019-12-27 Firefox does not support
         //       the ES2018 regexp dotAll flag and Angular/tsc doesn't
         //       seem set up to transpile it
-        html = html.replace(/<!--([^]*?)-->/g, '');
+        let previousHtml;
+        do {
+            previousHtml = html;
+            html = html.replace(/<!--([^]*?)-->/g, '');
+        } while (html !== previousHtml);
 
         const lines = html.split(/\n/);
         const newLines = [];
@@ -57,23 +62,14 @@ export class HtmlToTxtService {
             line = this.unEscapeHtml(line);
             line = this.entityToChars(line);
 
-            line = line.replace(/<head.*?>.*?<\/head>/gi, '');
-            line = line.replace(/<br.*?>/gi, '\r\n');
-            line = line.replace(/<table.*?>/gi, '');
-            line = line.replace(/<\/tr>/gi, '\r\n'); // end of row
-            line = line.replace(/<\/td>/gi, ' '); // end of cell
-            line = line.replace(/<\/th>/gi, ' '); // end of th
-            line = line.replace(/<tr.*?>/gi, '');
-            line = line.replace(/<hr.*?>/gi, '\r\n');
-            line = line.replace(/<p.*?>/gi, '');
-            line = line.replace(/<block.*?>/gi, '');
-            line = line.replace(/<li.*?>/gi, ' * ');
-            line = line.replace(/<.+?>/gi, '');
+            line = sanitizeHtml(line, {
+                allowedTags: [],
+                allowedAttributes: {}
+            });
 
             if (line) { newLines.push(line); }
         });
 
         return newLines.join('\n');
     }
 }
-

Open-ILS/src/eg2/src/app/staff/acq/invoice/invoice.component.html

@@ -47,11 +47,6 @@
             <span class="material-icons small me-1" aria-hidden="true">print</span>
             <span i18n>Print</span>
           </a>-->
-          <ng-container *ngIf="showLegacyLinks">
-            <a href="/eg/staff/acq/legacy/invoice/view/{{invoiceId()}}" target="_blank">
-              Show Invoice in Legacy Interface
-            </a>
-          </ng-container>
           <ng-container *ngIf="isTop">
             <button type="button" (click)="toggleFmEditor()"
                     class="btn btn-normal label-with-material-icon"
@@ -63,6 +58,11 @@
                                          class="material-icons mat-icon-in-button">unfold_less</span>
             </button>
           </ng-container>
+          <ng-container *ngIf="showLegacyLinks && invoiceId()">
+            <a href="/eg/staff/acq/legacy/invoice/view/{{invoiceId()}}" target="_blank">
+              Show Invoice in Legacy Interface
+            </a>
+          </ng-container>
         </div>
       </div>
     </div>

Open-ILS/src/eg2/src/app/staff/acq/invoice/invoice.component.ts

@@ -15,6 +15,7 @@ import {InvoiceChargesComponent} from './charges.component';
 import {PoService} from '../po/po.service';
 import {LineitemResultsComponent} from '@eg/staff/acq/search/lineitem-results.component';
 import {firstValueFrom, Subscription} from 'rxjs';
+import { ServerStoreService } from '@eg/core/server-store.service';
 
 @Component({
     templateUrl: 'invoice.component.html',
@@ -38,6 +39,7 @@ export class InvoiceComponent implements OnInit, OnDestroy, CanComponentDeactiva
     needs_invoice_create_perm = true;
     needs_invoice_view_perm = true;
     showFmEditor = true;
+    showLegacyLinks = false;
 
     @ViewChildren(LineitemResultsComponent) liResults: QueryList<LineitemResultsComponent>;
     @ViewChild(InvoiceDetailsComponent, { static: false }) invoiceDetails: InvoiceDetailsComponent;
@@ -56,7 +58,8 @@ export class InvoiceComponent implements OnInit, OnDestroy, CanComponentDeactiva
         private perm: PermService,
         private pcrud: PcrudService,
         public  invoiceService: InvoiceService,
-        public  poService: PoService
+        public  poService: PoService,
+        public  store: ServerStoreService
     ) {}
 
     ngOnInit() {
@@ -88,6 +91,11 @@ export class InvoiceComponent implements OnInit, OnDestroy, CanComponentDeactiva
         this.onTabChange = ($event) => {
             this.showFmEditor = $event.nextId === 'main';
         };
+
+        this.store.getItemBatch(['ui.staff.acq.show_deprecated_links'])
+            .then(settings => {
+                this.showLegacyLinks = settings['ui.staff.acq.show_deprecated_links'];
+        });
     }
 
     async loadPerms(): Promise<void> {

Open-ILS/src/eg2/src/app/staff/acq/lineitem/from-bib-ids.component.ts

@@ -119,7 +119,7 @@ export class LineitemFromBibIdsComponent implements OnInit {
                     this.bibIdMap[f.name] = (e.target.result as string). // text content
                         split('\n'). // split to lines
             	        filter(o => Boolean(o.length > 0)). // line isn't empty
-        	            map(l => l.replace('\r','').split(',')[0]). // take first field
+        	            map(l => l.replace(/\r/g,'').split(',')[0]). // take first field
             	        filter(o => Boolean(o.length > 0)). // first field has content
                         map(o => o.match(/^".+"$/) ? o.slice(1,-1) : o). // remove quotes
                         filter(o => Boolean(o.match(/^\d+$/))). // and it's a number

Open-ILS/src/eg2/src/app/staff/admin/local/shelving_location_groups/shelving_location_groups.component.ts

@@ -342,7 +342,7 @@ export class ShelvingLocationGroupsComponent implements OnInit {
 
         this.draggedElement = group;
         this.assignNewPositions(index, index - 1);
-        setTimeout($event.target.focus());
+        setTimeout(() => $event.target.focus(), 0);
     }
 
     moveDown($event, group, index) {
@@ -353,7 +353,7 @@ export class ShelvingLocationGroupsComponent implements OnInit {
 
         this.draggedElement = group;
         this.assignNewPositions(index, index + 1);
-        setTimeout($event.target.focus());
+        setTimeout(() => $event.target.focus(), 0);
     }
 
     onDragStart = (event, locationGroup) => {

Open-ILS/src/eg2/src/app/staff/reporter/full/definition.component.html

@@ -60,8 +60,8 @@
 	  <label class="form-label" i18n>Template Documentation</label>
 	</div>
 	<div class="col-lg-8">
-  	<a *ngIf="templ.doc_url.match('\s*https?:')" id="documentation-link" href="{{templ.doc_url}}">{{templ.doc_url}}</a>
-  	<span *ngIf="!templ.doc_url.match('\s*https?:')" id="documentation-text">{{templ.doc_url}}</span>
+  	<a *ngIf="templ.doc_url.match('\\s*https?:')" id="documentation-link" href="{{templ.doc_url}}">{{templ.doc_url}}</a>
+  	<span *ngIf="!templ.doc_url.match('\\s*https?:')" id="documentation-text">{{templ.doc_url}}</span>
 	</div>
 </div>
 

Open-ILS/src/eg2/src/app/staff/reporter/full/my-reports.component.html

@@ -62,7 +62,7 @@
   <div *ngIf="row.documentation?.match('^\s*https?:')">
     <a href="{{row.documentation}}" target="_blank" i18n>Template Documentation</a>
   </div>
-  <span *ngIf="!row.documentation?.match('^\s*https?:')">
+  <span *ngIf="!row.documentation?.match('^\\s*https?:')">
     {{row.documentation}}
   </span>
 </ng-template>

Open-ILS/src/eg2/src/app/staff/reporter/full/my-templates.component.html

@@ -51,10 +51,10 @@
 ></eg-prompt-dialog>
 
 <ng-template #docURLTmpl let-row="row">
-  <div *ngIf="row.documentation?.match('^\s*https?:')">
+  <div *ngIf="row.documentation?.match('^\\s*https?:')">
     <a href="{{row.documentation}}" target="_blank" i18n>Template Documentation</a>
   </div>
-  <span *ngIf="!row.documentation?.match('^\s*https?:')">
+  <span *ngIf="!row.documentation?.match('^\\s*https?:')">
     {{row.documentation}}
   </span>
 </ng-template>

Open-ILS/src/eg2/src/app/staff/share/buckets/record-bucket-item.component.ts

@@ -237,7 +237,7 @@ export class RecordBucketItemComponent implements OnInit {
             let url = `/exporter?containerid=${this.bucket.id()}`;
             if (options.format) { url += `&format=${options.format}`; }
             if (options.encoding) { url += `&encoding=${options.encoding}`; }
-            if (options.holdings) { url += '&holdings=1'; }
+            if (options.includeItems) { url += '&holdings=1'; }
             url += `&ses=${this.auth.token()}`;
             window.open(url, '_blank');
         }
@@ -251,7 +251,7 @@ export class RecordBucketItemComponent implements OnInit {
             url += idParams;
             if (options.format) { url += `&format=${encodeURIComponent(options.format)}`; }
             if (options.encoding) { url += `&encoding=${encodeURIComponent(options.encoding)}`; }
-            if (options.holdings) { url += '&holdings=1'; }
+            if (options.includeItems) { url += '&holdings=1'; }
             url += `&ses=${encodeURIComponent(this.auth.token())}`;
             window.open(url, '_blank');
         }

Open-ILS/src/eg2/src/app/staff/share/marc-edit/charmap/charmap-dialog.component.ts

@@ -38,12 +38,12 @@ export class CharMapDialogComponent extends DialogComponent implements OnInit {
 
     @HostListener('window:keydown', ['$event'])
     focusHeading($event) {
+        if (!this.modalRef) {return;} // don't grab keydown if the charmap modal isn't open
         if (this.disableAccessKeys) {return;}
         // console.debug("Keydown ", $event.key);
         const letters = '0123456789abcdefghijklmnopqrstuvwxyz'.split('');
         if (letters.includes($event.key)) {
-            $event.preventDefault();
-            const el = document.querySelector('[data-index='+$event.key+']') as HTMLElement;
+            const el = document.querySelector('[data-index='+String($event.key)+']') as HTMLElement;
             setTimeout(() => el?.focus());
         }
     }

Open-ILS/src/eg2/src/app/staff/share/marc-edit/editor.component.ts

@@ -143,11 +143,11 @@ export class MarcEditorComponent implements OnInit {
 
     // Remember the last used tab as the preferred tab.
     tabChange(evt: NgbNavChangeEvent) {
-
         // Avoid undo persistence across tabs since that could result
         // in changes getting lost.
         this.context.resetUndos();
 
+        this.editorTab = evt.nextId;
         if (evt.nextId === 'flat') {
             this.store.setItem('cat.marcedit.flateditor', true);
         } else {

Open-ILS/src/eg2/src/assets/js/marcrecord.js

@@ -292,7 +292,7 @@ var MARC21 = {
             function df_line_data (l) { return l.substring(6) || '' };
             function line_tag (l) { return l.substring(0,3) };
             function df_ind1 (l) { return l.substring(4,5).replace('\\',' ') };
-            function df_ind2 (l) { return l.substring(5,6).replace('\\',' ') };
+            function df_ind2 (l) { return l.substring(5,6).replace(/\\/g,' ') };
             function isControlField (l) {
                 var x = line_tag(l);
                 return (x == 'LDR' || x < '010') ? true : false;

Open-ILS/src/extras/opensearchportal.html

@@ -160,7 +160,12 @@
 			if (cur_src.childNodes[i].nodeValue == turi)
 				return;
 		}
-		cur_src.innerHTML += '<a name="' + single_source + '" href="' + turi + '">' + turi + '</a><br>';
+		var a = document.createElement('a');
+		a.name = single_source;
+		a.href = turi;
+		a.textContent = turi;
+		cur_src.appendChild(a);
+		cur_src.appendChild(document.createElement('br'));
 		perform_search(single_source);
 		return;
 	}

Open-ILS/src/reporter/clark-kent.pl

@@ -28,6 +28,7 @@
 use Email::Send;
 use Scalar::Util 'looks_like_number';
 use List::MoreUtils qw/uniq/;
+use sigtrap qw/handler die_signal normal-signals/;
 
 use open ':utf8';
 
@@ -1165,3 +1166,8 @@ sub pivot_data {
 }
 
 
+sub die_signal {
+    my $sig = shift;
+    $logger->warn("Reporter received signal $sig");
+    exit(0);
+}