From d437dec91c5e28de167a78be4047ea3b955193fc Mon Sep 17 00:00:00 2001
From: crschmidt <crschmidt@crschmidt.net>
Date: Sat, 2 Aug 2008 21:56:25 +0000
Subject: [PATCH] Since the Sundials is our primary KML + bubbles example, put
 in some naive Javascript <script> injection protection, so that people are at
 least aware of the issue. This will search for <script and if it exists,
 escape the content so that it doesn't execute.

git-svn-id: http://svn.openlayers.org/trunk/openlayers@7679 dc9f47b5-9b13-0410-9fdd-eb0c1a62fdaf
---
 examples/sundials.html | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/examples/sundials.html b/examples/sundials.html
index 9ed3b12788..ca29bcaf05 100644
--- a/examples/sundials.html
+++ b/examples/sundials.html
@@ -45,10 +45,16 @@
         }
         function onFeatureSelect(feature) {
             selectedFeature = feature;
+            // Since KML is user-generated, do naive protection against
+            // Javascript.
+            var content = "<h2>"+feature.attributes.name + "</h2>" + feature.attributes.description;
+            if (content.search("<script") != -1) {
+                content = "Content contained Javascript! Escaped content below.<br />" + content.replace(/</g, "&lt;");
+            }
             popup = new OpenLayers.Popup.FramedCloud("chicken", 
                                      feature.geometry.getBounds().getCenterLonLat(),
                                      new OpenLayers.Size(100,100),
-                                     "<h2>"+feature.attributes.name + "</h2>" + feature.attributes.description,
+                                     content,
                                      null, true, onPopupClose);
             feature.popup = popup;
             map.addPopup(popup);