diff --git a/cms/static/js/views/pages/container.js b/cms/static/js/views/pages/container.js index f4e5ac8bdc..ed9957b10a 100644 --- a/cms/static/js/views/pages/container.js +++ b/cms/static/js/views/pages/container.js @@ -343,7 +343,7 @@ define(['jquery', 'underscore', 'backbone', 'gettext', 'js/views/pages/base_page updateHtml: function(element, html) { // Replace the element with the new HTML content, rather than adding // it as child elements. - this.$el = $(html).replaceAll(element); // safe-lint: disable=javascript-jquery-insertion + this.$el = $(html).replaceAll(element); // xss-lint: disable=javascript-jquery-insertion } }); temporaryView = new TemporaryXBlockView({ diff --git a/common/lib/xmodule/xmodule/js/src/problem/edit.js b/common/lib/xmodule/xmodule/js/src/problem/edit.js index 0f8fc172db..7aa6159d49 100644 --- a/common/lib/xmodule/xmodule/js/src/problem/edit.js +++ b/common/lib/xmodule/xmodule/js/src/problem/edit.js @@ -344,7 +344,7 @@ for (i = 0; i < options.length; i += 1) { inner = /\s*\|\|(.*?)\|\|/.exec(options[i]); if (inner) { - // safe-lint: disable=javascript-concat-html + // xss-lint: disable=javascript-concat-html demandhints += ' ' + inner[1].trim() + '\n'; } } @@ -601,9 +601,9 @@ hintLine = ''; if (textHint.hint) { firstAnswer = textHint.nothint; - // safe-lint: disable=javascript-concat-html + // xss-lint: disable=javascript-concat-html hintLine = ' ' + - // safe-lint: disable=javascript-concat-html + // xss-lint: disable=javascript-concat-html textHint.hint + '\n'; } @@ -611,16 +611,16 @@ if (isRangeToleranceCase(firstAnswer)) { // [5, 7) or (5, 7), or (1.2345 * (2+3), 7*4 ] - range tolerance case // = (5*2)*3 should not be used as range tolerance - // safe-lint: disable=javascript-concat-html + // xss-lint: disable=javascript-concat-html numericalResponseString = '\n'; } else { answerData = getAnswerData(firstAnswer); - // safe-lint: disable=javascript-concat-html + // xss-lint: disable=javascript-concat-html numericalResponseString = '\n'; if (answerData.default) { - // safe-lint: disable=javascript-concat-html + // xss-lint: disable=javascript-concat-html numericalResponseString += ' \n'; } } @@ -644,15 +644,15 @@ } if (additionalTextHint.hint) { - // safe-lint: disable=javascript-concat-html + // xss-lint: disable=javascript-concat-html additionalHintLine = '' + - // safe-lint: disable=javascript-concat-html + // xss-lint: disable=javascript-concat-html additionalTextHint.hint + ''; } - // safe-lint: disable=javascript-concat-html + // xss-lint: disable=javascript-concat-html additionalAnswerString += ' '; additionalAnswerString += additionalHintLine; additionalAnswerString += '\n'; @@ -765,7 +765,7 @@ responseTypesSelector = responseTypes.join(', '); // make temporary xml - // safe-lint: disable=javascript-concat-html + // xss-lint: disable=javascript-concat-html $xml = $($.parseXML('' + xml + '')); responseType = $xml.find(responseTypesSelector); @@ -783,7 +783,7 @@ } if (beforeInputtype) { - // safe-lint: disable=javascript-jquery-insert-into-target + // xss-lint: disable=javascript-jquery-insert-into-target responseType[0].insertBefore(child, inputtype); } else { responseType[0].appendChild(child); @@ -814,11 +814,11 @@ }); finalDemandHints = ''; if (demandHintTags.length) { - // safe-lint: disable=javascript-concat-html + // xss-lint: disable=javascript-concat-html finalDemandHints = '\n\n' + demandHintTags.join('') + ''; } // make all responsetypes descendants of a single problem element - // safe-lint: disable=javascript-concat-html + // xss-lint: disable=javascript-concat-html finalXml = '\n' + responseTypesXML.join('\n\n') + finalDemandHints + '\n'; return finalXml; }; diff --git a/common/lib/xmodule/xmodule/js/src/video/09_video_caption.js b/common/lib/xmodule/xmodule/js/src/video/09_video_caption.js index 2183ece093..83a4554dab 100644 --- a/common/lib/xmodule/xmodule/js/src/video/09_video_caption.js +++ b/common/lib/xmodule/xmodule/js/src/video/09_video_caption.js @@ -747,7 +747,7 @@ HtmlUtils.setHtml($($spanEl), HtmlUtils.HTML(text.toString())); - return $spanEl.wrap('
  • ').parent()[0]; // safe-lint: disable=javascript-jquery-insertion + return $spanEl.wrap('
  • ').parent()[0]; // xss-lint: disable=javascript-jquery-insertion }; return AsyncProcess.array(captions, process).done(function(list) { diff --git a/lms/templates/courseware/progress.html b/lms/templates/courseware/progress.html index 1381896150..34596885f4 100644 --- a/lms/templates/courseware/progress.html +++ b/lms/templates/courseware/progress.html @@ -32,7 +32,7 @@ from django.utils.http import urlquote_plus diff --git a/lms/templates/courseware/progress_graph.js b/lms/templates/courseware/progress_graph.js index d8609f6b8d..8c1bb8c9d9 100644 --- a/lms/templates/courseware/progress_graph.js +++ b/lms/templates/courseware/progress_graph.js @@ -64,27 +64,27 @@ $(function () { categoryData = categories[ section['category'] ] - ## Because this is Python (Mako) embedded in JavaScript, our safe linting script is + ## Because this is Python (Mako) embedded in JavaScript, our xss linting script is ## thoroughly confused. We should rewrite this file to remove Python/Mako. - ## safe-lint: disable=javascript-jquery-append + ## xss-lint: disable=javascript-jquery-append categoryData['data'].append( [tickIndex, section['percent']] ) ## Note that some courses had stored images in the Abbreviation. We are no longer ## allowing the display of such images, and remove any previously stored HTML ## to prevent ugly HTML from being shown to learners. - ## safe-lint: disable=javascript-jquery-append + ## xss-lint: disable=javascript-jquery-append ticks.append( [tickIndex, bleach.clean(section['label'], tags=[], strip=True)] ) if section['category'] in detail_tooltips: - ## safe-lint: disable=javascript-jquery-append + ## xss-lint: disable=javascript-jquery-append detail_tooltips[ section['category'] ].append( section['detail'] ) else: detail_tooltips[ section['category'] ] = [ section['detail'], ] if 'mark' in section: - ## safe-lint: disable=javascript-jquery-append + ## xss-lint: disable=javascript-jquery-append droppedScores.append( [tickIndex, 0.05] ) - ## safe-lint: disable=javascript-jquery-append + ## xss-lint: disable=javascript-jquery-append dropped_score_tooltips.append( section['mark']['detail'] ) tickIndex += 1 @@ -107,7 +107,7 @@ $(function () { else: color = colors[ extraColorIndex % len(colors) ] extraColorIndex += 1 - ## safe-lint: disable=javascript-jquery-append + ## xss-lint: disable=javascript-jquery-append series.append({ 'label' : section['category'] + "-grade_breakdown", 'data' : [ [overviewBarX, section['percent']] ], @@ -131,7 +131,7 @@ $(function () { descending_grades = sorted(grade_cutoffs, key=lambda x: grade_cutoffs[x], reverse=True) for grade in descending_grades: percent = grade_cutoffs[grade] - ## safe-lint: disable=javascript-jquery-append + ## xss-lint: disable=javascript-jquery-append grade_cutoff_ticks.append( [ percent, u"{0} {1:.0%}".format(grade, percent) ] ) else: grade_cutoff_ticks = [ ] @@ -284,7 +284,7 @@ $(function () { edx.HtmlUtils.append( $grade_detail_graph, edx.HtmlUtils.joinHtml( - // safe-lint: disable=javascript-concat-html + // xss-lint: disable=javascript-concat-html edx.HtmlUtils.HTML('
    '), edx.HtmlUtils.HTML(''), gettext('Overall Score'), diff --git a/lms/templates/discussion/_thread_list_template.html b/lms/templates/discussion/_thread_list_template.html index 9102737619..e47bf34a0b 100644 --- a/lms/templates/discussion/_thread_list_template.html +++ b/lms/templates/discussion/_thread_list_template.html @@ -20,7 +20,7 @@ %endif - ## safe-lint: disable=python-parse-error,python-wrap-html + ## xss-lint: disable=python-parse-error,python-wrap-html ${"<% if (isDiscussionDivisionEnabled && isPrivilegedUser) { %>" | n, decode.utf8}${"<% } %>" | n, decode.utf8}