prevent XSS in AQL editor

js/apps/system/aardvark/frontend/js/arango/arango.js

@@ -273,7 +273,7 @@ return returnVal;
 
       return dt.getUTCFullYear() + '-'
       + pad(dt.getUTCMonth() + 1) + '-'
-      + pad(dt.getUTCDate()) + ' <br>'
+      + pad(dt.getUTCDate()) + ' '
       + pad(dt.getUTCHours()) + ':'
       + pad(dt.getUTCMinutes()) + ':'
       + pad(dt.getUTCSeconds());

js/apps/system/aardvark/frontend/js/templates/arangoTable.ejs

@@ -14,7 +14,7 @@
     <% _.each(content.rows, function(k) { var counter=0;%>
       <tr>
         <% _.each(k, function(x) { %>
-          <td class="arangob-table-td table-cell<%=counter%>"><%=x%></td>
+          <td class="arangob-table-td table-cell<%=counter%>"><%=_.escape(x)%></td>
         <% counter++;});%>
       </tr>
     <%});%>

js/apps/system/aardvark/frontend/js/views/queryView.js

@@ -1,7 +1,7 @@
 /*jshint browser: true */
 /*jshint unused: false */
 /*global require, exports, Backbone, EJS, $, setTimeout, localStorage, ace, Storage, window, _ */
-/*global arangoHelper, templateEngine, jQuery, Joi*/
+/*global _, arangoHelper, templateEngine, jQuery, Joi*/
 
 (function () {
   "use strict";
@@ -123,7 +123,8 @@
           $('#modalButton1').addClass('button-warning');
           $('#modalButton1').text('Update');
             boolTemp = true;
-        } else {
+        } 
+        else {
           $('#modalButton1').removeClass('button-warning');
           $('#modalButton1').addClass('button-success');
           $('#modalButton1').text('Save');
@@ -188,9 +189,9 @@
       var sizeBox = $('#querySize');
       sizeBox.empty();
       [ 100, 250, 500, 1000, 2500, 5000 ].forEach(function (value) {
-        sizeBox.append('<option value="' + value + '"' +
+        sizeBox.append('<option value="' + _.escape(value) + '"' +
           (querySize === value ? ' selected' : '') +
-          '>' + value + ' results</option>');
+          '>' + _.escape(value) + ' results</option>');
       });
 
       var outputEditor = ace.edit("queryOutput");
@@ -469,8 +470,6 @@
       $('#querySelect').val(saveName);
     },
 
-
-
     getSystemQueries: function () {
       var self = this;
       $.ajax({
@@ -498,6 +497,7 @@
       });
       return returnVal;
     },
+
     importSelected: function (e) {
       var inputEditor = ace.edit("aqlEditor");
       $.each(this.queries, function (k, v) {
@@ -513,6 +513,7 @@
 
       this.deselect(ace.edit("aqlEditor"));
     },
+
     renderSelectboxes: function () {
       this.sortQueries();
       var selector = '';
@@ -523,16 +524,14 @@
 
         $(selector).append('<optgroup label="Example queries">');
         jQuery.each(this.queries, function (k, v) {
-          var escapedName = arangoHelper.escapeHtml(v.name);
+          $(selector).append('<option id="' + _.escape(v.name) + '">' + _.escape(v.name) + '</option>');
-          $(selector).append('<option id="' + escapedName + '">' + escapedName + '</option>');
         });
         $(selector).append('</optgroup>');
 
         if (this.customQueries.length > 0) {
           $(selector).append('<optgroup label="Custom queries">');
           jQuery.each(this.customQueries, function (k, v) {
-            var escapedName = arangoHelper.escapeHtml(v.name);
+            $(selector).append('<option id="' + _.escape(v.name) + '">' + _.escape(v.name) + '</option>');
-            $(selector).append('<option id="' + escapedName + '">' + escapedName + '</option>');
           });
           $(selector).append('</optgroup>');
         }