Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 53d054e

Browse files
scjodyscjody
authored
Merge pull request #804 from plotly/entity-decode-performance
Remove HTML entity decoding from convertToSVG
2 parents 8942fd3 + 7649e5d commit 53d054e

File tree

5 files changed

+30
-29
lines changed

5 files changed

+30
-29
lines changed

‎src/lib/svg_text_utils.js

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -252,8 +252,7 @@ function encodeForHTML(_str) {
252252
}
253253

254254
function convertToSVG(_str) {
255-
var htmlEntitiesDecoded = Plotly.util.html_entity_decode(_str);
256-
var result = htmlEntitiesDecoded
255+
var result = _str
257256
.split(/(<[^<>]*>)/).map(function(d) {
258257
var match = d.match(/<(\/?)([^ >]*)\s*(.*)>/i),
259258
tag = match && match[2].toLowerCase(),

‎src/plots/cartesian/axes.js

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1053,7 +1053,8 @@ function formatLinear(ax, out, hover, extraPrecision, hideexp) {
10531053
// new, more reliable procedure than d3.round or similar:
10541054
// add half the rounding increment, then stringify and truncate
10551055
// also automatically switch to sci. notation
1056-
var SIPREFIXES = ['f', 'p', 'n', '&mu;', 'm', '', 'k', 'M', 'G', 'T'];
1056+
var SIPREFIXES = ['f', 'p', 'n', 'μ', 'm', '', 'k', 'M', 'G', 'T'];
1057+
10571058
function numFormat(v, ax, fmtoverride, hover) {
10581059
// negative?
10591060
var isNeg = v < 0,
@@ -1144,7 +1145,7 @@ function numFormat(v, ax, fmtoverride, hover) {
11441145
v += 'E' + signedExponent;
11451146
}
11461147
else if(exponentFormat === 'power') {
1147-
v += '&times;10<sup>' + signedExponent + '</sup>';
1148+
v += '×10<sup>' + signedExponent + '</sup>';
11481149
}
11491150
else if(exponentFormat === 'B' && exponent === 9) {
11501151
v += 'B';

‎src/plots/cartesian/graph_interact.js

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -695,7 +695,7 @@ function cleanPoint(d, hovermode) {
695695
d.xLabel += ' +' + xeText + ' / -' +
696696
Axes.tickText(d.xa, d.xa.c2l(d.xerrneg), 'hover').text;
697697
}
698-
else d.xLabel += ' &plusmn; ' + xeText;
698+
else d.xLabel += ' ± ' + xeText;
699699

700700
// small distance penalty for error bars, so that if there are
701701
// traces with errors and some without, the error bar label will
@@ -708,7 +708,7 @@ function cleanPoint(d, hovermode) {
708708
d.yLabel += ' +' + yeText + ' / -' +
709709
Axes.tickText(d.ya, d.ya.c2l(d.yerrneg), 'hover').text;
710710
}
711-
else d.yLabel += ' &plusmn; ' + yeText;
711+
else d.yLabel += ' ± ' + yeText;
712712

713713
if(hovermode === 'y') d.distance += 1;
714714
}

‎test/image/mocks/axes_enumerated_ticks.json

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -33,7 +33,7 @@
3333
"xaxis": {
3434
"ticktext": [
3535
"<span style=\"fill:green\">green</span> eggs",
36-
"&amp; ham",
36+
"& ham",
3737
"H<sub>2</sub>O",
3838
"Gorgonzola"
3939
],
@@ -47,4 +47,4 @@
4747
]
4848
}
4949
}
50-
}
50+
}

‎test/jasmine/tests/svg_text_utils_test.js

Lines changed: 22 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -121,33 +121,34 @@ describe('svg+text utils', function() {
121121
});
122122

123123
it('wrap XSS attacks in href', function() {
124-
var textCases = [
125-
'<a href="XSS\" onmouseover=&quot;alert(1)\" style=&quot;font-size:300px">Subtitle</a>',
126-
'<a href="XSS&quot; onmouseover=&quot;alert(1)&quot; style=&quot;font-size:300px">Subtitle</a>'
127-
];
124+
var node = mockTextSVGElement(
125+
'<a href="XSS" onmouseover="alert(1)" style="font-size:300px">Subtitle</a>'
126+
);
128127

129-
textCases.forEach(function(textCase) {
130-
var node = mockTextSVGElement(textCase);
128+
expect(node.text()).toEqual('Subtitle');
129+
assertAnchorAttrs(node);
130+
assertAnchorLink(node, 'XSS onmouseover=alert(1) style=font-size:300px');
131+
});
131132

132-
expect(node.text()).toEqual('Subtitle');
133-
assertAnchorAttrs(node);
134-
assertAnchorLink(node, 'XSS onmouseover=alert(1) style=font-size:300px');
135-
});
133+
it('wrap XSS attacks with quoted entities in href', function() {
134+
var node = mockTextSVGElement(
135+
'<a href="XSS&quot; onmouseover=&quot;alert(1)&quot; style=&quot;font-size:300px">Subtitle</a>'
136+
);
137+
138+
console.log(node.select('a').attr('xlink:href'));
139+
expect(node.text()).toEqual('Subtitle');
140+
assertAnchorAttrs(node);
141+
assertAnchorLink(node, 'XSS&quot; onmouseover=&quot;alert(1)&quot; style=&quot;font-size:300px');
136142
});
137143

138144
it('should keep query parameters in href', function() {
139-
var textCases = [
140-
'<a href="https://abc.com/myFeature.jsp?name=abc&pwd=def">abc.com?shared-key</a>',
141-
'<a href="https://abc.com/myFeature.jsp?name=abc&amp;pwd=def">abc.com?shared-key</a>'
142-
];
143-
144-
textCases.forEach(function(textCase) {
145-
var node = mockTextSVGElement(textCase);
145+
var node = mockTextSVGElement(
146+
'<a href="https://abc.com/myFeature.jsp?name=abc&pwd=def">abc.com?shared-key</a>'
147+
);
146148

147-
assertAnchorAttrs(node);
148-
expect(node.text()).toEqual('abc.com?shared-key');
149-
assertAnchorLink(node, 'https://abc.com/myFeature.jsp?name=abc&pwd=def');
150-
});
149+
assertAnchorAttrs(node);
150+
expect(node.text()).toEqual('abc.com?shared-key');
151+
assertAnchorLink(node, 'https://abc.com/myFeature.jsp?name=abc&pwd=def');
151152
});
152153

153154
it('allow basic spans', function() {

0 commit comments

Comments
 (0)