prevent XSS in AQL editor

js/apps/system/aardvark/frontend/js/arango/arango.js

@@ -273,7 +273,7 @@ return returnVal;
 
       return dt.getUTCFullYear() + '-'
       + pad(dt.getUTCMonth() + 1) + '-'
-      + pad(dt.getUTCDate()) + ' <br>'
+      + pad(dt.getUTCDate()) + ' '
       + pad(dt.getUTCHours()) + ':'
       + pad(dt.getUTCMinutes()) + ':'
       + pad(dt.getUTCSeconds());

js/apps/system/aardvark/frontend/js/templates/arangoTable.ejs

@@ -14,7 +14,7 @@
     <% _.each(content.rows, function(k) { var counter=0;%>
       <tr>
         <% _.each(k, function(x) { %>
-          <td class="arangob-table-td table-cell<%=counter%>"><%=x%></td>
+          <td class="arangob-table-td table-cell<%=counter%>"><%=_.escape(x)%></td>
         <% counter++;});%>
       </tr>
     <%});%>

js/apps/system/aardvark/frontend/js/views/logsView.js

@@ -71,7 +71,7 @@
 
     invertArray: function (array) {
       var rtnArr = [], counter = 0, i;
-      for (i = array.length-1; i >= 0; i--) {
+      for (i = array.length - 1; i >= 0; i--) {
         rtnArr[counter] = array[i];
         counter++;
       }

js/apps/system/aardvark/frontend/js/views/queryView.js

@@ -1,7 +1,7 @@
 /*jshint browser: true */
 /*jshint unused: false */
 /*global require, exports, Backbone, EJS, $, setTimeout, localStorage, ace, Storage, window, _ */
-/*global arangoHelper, templateEngine, jQuery, Joi*/
+/*global _, arangoHelper, templateEngine, jQuery, Joi*/
 
 (function () {
   "use strict";
@@ -73,10 +73,10 @@
         {'keyup #new-query-name' : this.listenKey.bind(this)});
     },
 
-    updateTable:  function () {
+    updateTable: function () {
       this.tableDescription.rows = this.customQueries;
 
-      _.each(this.tableDescription.rows, function(k,v) {
+      _.each(this.tableDescription.rows, function(k, v) {
         k.thirdRow = '<a class="deleteButton"><span class="icon_arangodb_roundminus"' +
               ' title="Delete query"></span></a>';
       });
@@ -123,7 +123,8 @@
           $('#modalButton1').addClass('button-warning');
           $('#modalButton1').text('Update');
             boolTemp = true;
-        } else {
+        } 
+        else {
           $('#modalButton1').removeClass('button-warning');
           $('#modalButton1').addClass('button-success');
           $('#modalButton1').text('Save');
@@ -188,9 +189,9 @@
       var sizeBox = $('#querySize');
       sizeBox.empty();
       [ 100, 250, 500, 1000, 2500, 5000 ].forEach(function (value) {
-        sizeBox.append('<option value="' + value + '"' +
+        sizeBox.append('<option value="' + _.escape(value) + '"' +
           (querySize === value ? ' selected' : '') +
-          '>' + value + ' results</option>');
+          '>' + _.escape(value) + ' results</option>');
       });
 
       var outputEditor = ace.edit("queryOutput");
@@ -433,12 +434,12 @@
       //check for already existing entry
       var quit = false;
       $.each(this.customQueries, function (k, v) {
-          if (v.name === saveName) {
-            v.value = content;
-            quit = !isUpdate;
-            return;
-          }
-        });
+        if (v.name === saveName) {
+          v.value = content;
+          quit = !isUpdate;
+          return;
+        }
+      });
 
       if (quit === true) {
         //Heiko: Form-Validator - name already taken
@@ -446,7 +447,7 @@
         return;
       }
 
-      if (!isUpdate) {
+      if (! isUpdate) {
         //this.customQueries.push({
          // name: saveName,
          // value: content
@@ -469,8 +470,6 @@
       $('#querySelect').val(saveName);
     },
 
-
-
     getSystemQueries: function () {
       var self = this;
       $.ajax({
@@ -498,6 +497,7 @@
       });
       return returnVal;
     },
+
     importSelected: function (e) {
       var inputEditor = ace.edit("aqlEditor");
       $.each(this.queries, function (k, v) {
@@ -513,6 +513,7 @@
 
       this.deselect(ace.edit("aqlEditor"));
     },
+
     renderSelectboxes: function () {
       this.sortQueries();
       var selector = '';
@@ -523,16 +524,14 @@
 
         $(selector).append('<optgroup label="Example queries">');
         jQuery.each(this.queries, function (k, v) {
-          var escapedName = arangoHelper.escapeHtml(v.name);
-          $(selector).append('<option id="' + escapedName + '">' + escapedName + '</option>');
+          $(selector).append('<option id="' + _.escape(v.name) + '">' + _.escape(v.name) + '</option>');
         });
         $(selector).append('</optgroup>');
 
         if (this.customQueries.length > 0) {
           $(selector).append('<optgroup label="Custom queries">');
           jQuery.each(this.customQueries, function (k, v) {
-            var escapedName = arangoHelper.escapeHtml(v.name);
-            $(selector).append('<option id="' + escapedName + '">' + escapedName + '</option>');
+            $(selector).append('<option id="' + _.escape(v.name) + '">' + _.escape(v.name) + '</option>');
           });
           $(selector).append('</optgroup>');
         }
@@ -614,7 +613,7 @@
       var changeTab = function (element, index, array){
         var divId = "#" + element.replace("-switch", "");
         var contentDivId = "#tabContent" + divId.charAt(1).toUpperCase() + divId.substr(2);
-        if ( element === switchId){
+        if (element === switchId) {
           $("#" + element).parent().addClass("active");
           $(divId).addClass("active");
           $(contentDivId).show();