Fix #905 Potential XSS on template generation

Author: mistic100

src/core.js

@@ -345,7 +345,7 @@ QueryBuilder.prototype.setRoot = function(addRule, data, flags) {
     addRule = (addRule === undefined || addRule === true);
 
     var group_id = this.nextGroupId();
-    var $group = $(this.getGroupTemplate(group_id, 1));
+    var $group = $($.parseHTML(this.getGroupTemplate(group_id, 1)));
 
     this.$el.append($group);
     this.model.root = new Group(null, $group);
@@ -535,7 +535,7 @@ QueryBuilder.prototype.addRule = function(parent, data, flags) {
     }
 
     var rule_id = this.nextRuleId();
-    var $rule = $(this.getRuleTemplate(rule_id));
+    var $rule = $($.parseHTML(this.getRuleTemplate(rule_id)));
     var model = parent.addRule($rule);
 
     model.data = data;
@@ -625,7 +625,7 @@ QueryBuilder.prototype.createRuleFilters = function(rule) {
      * @returns {QueryBuilder.Filter[]}
      */
     var filters = this.change('getRuleFilters', this.filters, rule);
-    var $filterSelect = $(this.getRuleFilterSelect(rule, filters));
+    var $filterSelect = $($.parseHTML(this.getRuleFilterSelect(rule, filters)));
 
     rule.$el.find(QueryBuilder.selectors.filter_container).html($filterSelect);
 
@@ -654,7 +654,7 @@ QueryBuilder.prototype.createRuleOperators = function(rule) {
     }
 
     var operators = this.getOperators(rule.filter);
-    var $operatorSelect = $(this.getRuleOperatorSelect(rule, operators));
+    var $operatorSelect = $($.parseHTML(this.getRuleOperatorSelect(rule, operators)));
 
     $operatorContainer.html($operatorSelect);
 
@@ -700,7 +700,7 @@ QueryBuilder.prototype.createRuleInput = function(rule) {
     var filter = rule.filter;
 
     for (var i = 0; i < rule.operator.nb_inputs; i++) {
-        var $ruleInput = $(this.getRuleInput(rule, i));
+        var $ruleInput = $($.parseHTML(this.getRuleInput(rule, i)));
         if (i > 0) $valueContainer.append(this.settings.inputs_separator);
         $valueContainer.append($ruleInput);
         $inputs = $inputs.add($ruleInput);

src/plugins/bt-tooltip-errors/plugin.js

@@ -15,7 +15,7 @@ QueryBuilder.define('bt-tooltip-errors', function(options) {
 
     // add BT Tooltip data
     this.on('getRuleTemplate.filter getGroupTemplate.filter', function(h) {
-        var $h = $(h.value);
+        var $h = $($.parseHTML(h.value));
         $h.find(QueryBuilder.selectors.error_container).attr('data-toggle', 'tooltip');
         h.value = $h.prop('outerHTML');
     });

src/plugins/filter-description/plugin.js

@@ -19,7 +19,7 @@ QueryBuilder.define('filter-description', function(options) {
             }
             else {
                 if ($p.length === 0) {
-                    $p = $('<p class="filter-description"></p>');
+                    $p = $($.parseHTML('<p class="filter-description"></p>'));
                     $p.appendTo(rule.$el);
                 }
                 else {
@@ -49,7 +49,7 @@ QueryBuilder.define('filter-description', function(options) {
             }
             else {
                 if ($b.length === 0) {
-                    $b = $('<button type="button" class="btn btn-xs btn-info filter-description" data-toggle="popover"><i class="' + options.icon + '"></i></button>');
+                    $b = $($.parseHTML('<button type="button" class="btn btn-xs btn-info filter-description" data-toggle="popover"><i class="' + options.icon + '"></i></button>'));
                     $b.prependTo(rule.$el.find(QueryBuilder.selectors.rule_actions));
 
                     $b.popover({
@@ -89,7 +89,7 @@ QueryBuilder.define('filter-description', function(options) {
             }
             else {
                 if ($b.length === 0) {
-                    $b = $('<button type="button" class="btn btn-xs btn-info filter-description" data-toggle="bootbox"><i class="' + options.icon + '"></i></button>');
+                    $b = $($.parseHTML('<button type="button" class="btn btn-xs btn-info filter-description" data-toggle="bootbox"><i class="' + options.icon + '"></i></button>'));
                     $b.prependTo(rule.$el.find(QueryBuilder.selectors.rule_actions));
 
                     $b.on('click', function() {

src/plugins/invert/plugin.js

@@ -31,7 +31,7 @@ QueryBuilder.define('invert', function(options) {
     // Modify templates
     if (!options.disable_template) {
         this.on('getGroupTemplate.filter', function(h) {
-            var $h = $(h.value);
+            var $h = $($.parseHTML(h.value));
             $h.find(Selectors.condition_container).after(
                 '<button type="button" class="btn btn-xs btn-default" data-invert="group">' +
                 '<i class="' + options.icon + '"></i> ' + self.translate('invert') +
@@ -42,7 +42,7 @@ QueryBuilder.define('invert', function(options) {
 
         if (options.display_rules_button && options.invert_rules) {
             this.on('getRuleTemplate.filter', function(h) {
-                var $h = $(h.value);
+                var $h = $($.parseHTML(h.value));
                 $h.find(Selectors.rule_actions).prepend(
                     '<button type="button" class="btn btn-xs btn-default" data-invert="rule">' +
                     '<i class="' + options.icon + '"></i> ' + self.translate('invert') +

src/plugins/not-group/plugin.js

@@ -32,7 +32,7 @@ QueryBuilder.define('not-group', function(options) {
     // Modify templates
     if (!options.disable_template) {
         this.on('getGroupTemplate.filter', function(h) {
-            var $h = $(h.value);
+            var $h = $($.parseHTML(h.value));
             $h.find(QueryBuilder.selectors.condition_container).prepend(
                 '<button type="button" class="btn btn-xs btn-default" data-not="group">' +
                 '<i class="' + options.icon_unchecked + '"></i> ' + self.translate('NOT') +

src/plugins/sortable/plugin.js

@@ -63,7 +63,7 @@ QueryBuilder.define('sortable', function(options) {
                             .addClass('dragging');
 
                         // create drop placeholder
-                        var ph = $('<div class="rule-placeholder">&nbsp;</div>')
+                        var ph = $($.parseHTML('<div class="rule-placeholder">&nbsp;</div>'))
                             .height(src.$el.outerHeight());
 
                         placeholder = src.parent.addRule(ph, src.getPos());
@@ -162,14 +162,14 @@ QueryBuilder.define('sortable', function(options) {
     if (!options.disable_template) {
         this.on('getGroupTemplate.filter', function(h, level) {
             if (level > 1) {
-                var $h = $(h.value);
+                var $h = $($.parseHTML(h.value));
                 $h.find(QueryBuilder.selectors.condition_container).after('<div class="drag-handle"><i class="' + options.icon + '"></i></div>');
                 h.value = $h.prop('outerHTML');
             }
         });
 
         this.on('getRuleTemplate.filter', function(h) {
-            var $h = $(h.value);
+            var $h = $($.parseHTML(h.value));
             $h.find(QueryBuilder.selectors.rule_header).after('<div class="drag-handle"><i class="' + options.icon + '"></i></div>');
             h.value = $h.prop('outerHTML');
         });