From b2bf3ce391aa1427f5ba03e51208935fa0be7509 Mon Sep 17 00:00:00 2001 From: ahstro Date: Sat, 3 Oct 2015 11:23:41 +0200 Subject: [PATCH 01/33] Truncate a string: Minor typo The assert message said `1`, instead of the number `11` that was actually being used in the assertion. --- seed/challenges/basic-bonfires.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/seed/challenges/basic-bonfires.json b/seed/challenges/basic-bonfires.json index 931c157ce1..12da55a771 100644 --- a/seed/challenges/basic-bonfires.json +++ b/seed/challenges/basic-bonfires.json @@ -378,7 +378,7 @@ "truncate(\"A-tisket a-tasket A green and yellow basket\", 11, \"\");" ], "tests": [ - "assert(truncate(\"A-tisket a-tasket A green and yellow basket\", 11) === \"A-tisket...\", 'message: truncate(\"A-tisket a-tasket A green and yellow basket\", 1) should return \"A-tisket...\".');", + "assert(truncate(\"A-tisket a-tasket A green and yellow basket\", 11) === \"A-tisket...\", 'message: truncate(\"A-tisket a-tasket A green and yellow basket\", 11) should return \"A-tisket...\".');", "assert(truncate(\"Peter Piper picked a peck of pickled peppers\", 14) === \"Peter Piper...\", 'message: truncate(\"Peter Piper picked a peck of pickled peppers\", 14) should return \"Peter Piper...\".');", "assert(truncate(\"A-tisket a-tasket A green and yellow basket\", \"A-tisket a-tasket A green and yellow basket\".length) === \"A-tisket a-tasket A green and yellow basket\", 'message: truncate(\"A-tisket a-tasket A green and yellow basket\", \"A-tisket a-tasket A green and yellow basket\".length) should return \"A-tisket a-tasket A green and yellow basket\".');", "assert(truncate('A-tisket a-tasket A green and yellow basket', 'A-tisket a-tasket A green and yellow basket'.length + 2) === 'A-tisket a-tasket A green and yellow basket', 'message: truncate(\"A-tisket a-tasket A green and yellow basket\", \"A-tisket a-tasket A green and yellow basket\".length + 2) should return \"A-tisket a-tasket A green and yellow basket\".');" From c04832d61846db4131ad566feaac51495a2e8464 Mon Sep 17 00:00:00 2001 From: Florencia Tarditti Date: Mon, 5 Oct 2015 21:26:18 +0200 Subject: [PATCH 02/33] fix bootstrap fluid containers wording issue Closes #2467. --- seed/challenges/bootstrap.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/seed/challenges/bootstrap.json b/seed/challenges/bootstrap.json index d405871390..3982fe18d5 100644 --- a/seed/challenges/bootstrap.json +++ b/seed/challenges/bootstrap.json @@ -9,7 +9,7 @@ "Now let's go back to our Cat Photo App. This time, we'll style it using the popular Bootstrap responsive CSS framework.", "Bootstrap will figure out how wide your screen is and respond by resizing your HTML elements - hence the name Responsive Design.", "With responsive design, there is no need to design a mobile version of your website. It will look good on devices with screens of any width.", - "You can add Bootstrap to any app just by including it with <link rel=\"stylesheet\" href=\"//maxcdn.bootstrapcdn.com/bootstrap/3.3.1/css/bootstrap.min.css\"/> at the top of your HTML. But we've gone ahead and automatically added it to your Cat Photo App for you.", + "You can add Bootstrap to any app just by including it with <link rel=\"stylesheet\" href=\"//maxcdn.bootstrapcdn.com/bootstrap/3.3.1/css/bootstrap.min.css\"/> at the top of your HTML. But we've added it for you to this page behind the scenes.", "To get started, we should nest all of our HTML in a div element with the class container-fluid." ], "tests": [ From 7a31cdd9224fed8b4fe84f1ffdb7594e3f599979 Mon Sep 17 00:00:00 2001 From: ahstro Date: Tue, 6 Oct 2015 10:27:29 +0200 Subject: [PATCH 03/33] 'Regular Expressions'-waypoint improvements * Remove unnecessary `i`-flag from tests and test messages, e.g. `/\s+/gi` => `/\s+/g` * Remove dupliate backslashes from regex test messages, e.g. `/\\s+/g` => `/\s+/g` The two backslashes were probably just an accident caused by how multiple escapes are necessary with the current way tests are handled. The `i`-flag was just unnecessary since its purpose is to ignore the case of alphabetic characters. --- seed/challenges/basic-javascript.json | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/seed/challenges/basic-javascript.json b/seed/challenges/basic-javascript.json index c10af0def1..82a0430852 100644 --- a/seed/challenges/basic-javascript.json +++ b/seed/challenges/basic-javascript.json @@ -1039,7 +1039,7 @@ ], "tests":[ "assert(test === 2, 'message: Your RegEx should have found two numbers in the testString.');", - "assert(editor.getValue().match(/\\/\\\\d\\+\\//gi), 'message: You should be using the following expression /\\\\d+/gi to find the numbers in the testString.');" + "assert(editor.getValue().match(/\\/\\\\d\\+\\//g), 'message: You should be using the following expression /\\d+/g to find the numbers in the testString.');" ], "challengeSeed":[ "var test = (function() {", @@ -1047,7 +1047,7 @@ "", " // Only change code below this line.", "", - " var expression = /.+/gi;", + " var expression = /.+/g;", "", " // Only change code above this line.", " // We use this function to show you the value of your variable in your output box.", @@ -1069,7 +1069,7 @@ ], "tests":[ "assert(test === 7, 'message: Your RegEx should have found seven spaces in the testString.');", - "assert(editor.getValue().match(/\\/\\\\s\\+\\//gi), 'message: You should be using the following expression /\\\\s+/gi to find the spaces in the testString.');" + "assert(editor.getValue().match(/\\/\\\\s\\+\\//g), 'message: You should be using the following expression /\\s+/g to find the spaces in the testString.');" ], "challengeSeed":[ "var test = (function(){", @@ -1077,7 +1077,7 @@ "", " // Only change code below this line.", "", - " var expression = /.+/gi;", + " var expression = /.+/g;", "", " // Only change code above this line.", " // We use this function to show you the value of your variable in your output box.", @@ -1092,12 +1092,12 @@ "title": "Invert Regular Expression Matches with JavaScript", "difficulty":"9.987", "description":[ - "Use /\\S/gi to match everything that isn't a space in the string.", + "Use /\\S/g to match everything that isn't a space in the string.", "You can invert any match by using the uppercase version of the selector \\s versus \\S for example." ], "tests":[ "assert(test === 49, 'message: Your RegEx should have found forty nine non-space characters in the testString.');", - "assert(editor.getValue().match(/\\/\\\\S\\/gi/gi), 'message: You should be using the following expression /\\\\S/gi to find non-space characters in the testString.');" + "assert(editor.getValue().match(/\\/\\\\S\\/g/g), 'message: You should be using the following expression /\\S/g to find non-space characters in the testString.');" ], "challengeSeed":[ "var test = (function(){", @@ -1105,7 +1105,7 @@ "", " // Only change code below this line.", "", - " var expression = /./gi;", + " var expression = /./g;", "", " // Only change code above this line.", " // We use this function to show you the value of your variable in your output box.", From a6789b8511eca45f46e00393002b7231631a9c37 Mon Sep 17 00:00:00 2001 From: Gaurav Saxena Date: Tue, 6 Oct 2015 17:30:27 -0400 Subject: [PATCH 04/33] renamed -you- to -your- ; fixes #3607 - grammar bug --- seed/challenges/object-oriented-and-functional-programming.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/seed/challenges/object-oriented-and-functional-programming.json b/seed/challenges/object-oriented-and-functional-programming.json index 2d8c22f32d..2da91ee5a6 100644 --- a/seed/challenges/object-oriented-and-functional-programming.json +++ b/seed/challenges/object-oriented-and-functional-programming.json @@ -212,7 +212,7 @@ "});" ], "tests":[ - "assert(singleVal == 30, 'message: singleVal should have been set to the result of you reduce operation.');", + "assert(singleVal == 30, 'message: singleVal should have been set to the result of your reduce operation.');", "assert(editor.getValue().match(/\\.reduce\\(/gi), 'message: You should have made use of the reduce method.');" ], "challengeSeed":[ From 33e8f35bbf7c6036a24f16b1700b2a8da1ebbcf0 Mon Sep 17 00:00:00 2001 From: Berkeley Martinez Date: Tue, 6 Oct 2015 16:39:15 -0700 Subject: [PATCH 05/33] Fix replace script tags in URL Replace script tags in URL with fcc tags. This prevents some xss bugs blocking code from running in the iFrame. --- client/commonFramework.js | 76 ++++++++++++++++++++-------------- server/boot/user.js | 10 ++++- server/views/account/show.jade | 4 +- 3 files changed, 56 insertions(+), 34 deletions(-) diff --git a/client/commonFramework.js b/client/commonFramework.js index fcb1ccc58d..d4d86503c1 100644 --- a/client/commonFramework.js +++ b/client/commonFramework.js @@ -1,31 +1,49 @@ -// common namespace -// all classes should be stored here -var common = common || { - // init is an array of functions that are - // called at the beginning of dom ready - init: [] -}; +var common = (function() { + // common namespace + // all classes should be stored here + var common = window.common || { + // init is an array of functions that are + // called at the beginning of dom ready + init: [] + }; -common.challengeName = common.challengeName || window.challenge_Name ? - window.challenge_Name : - ''; + common.challengeName = common.challengeName || window.challenge_Name ? + window.challenge_Name : + ''; -common.challengeType = common.challengeType || window.challengeType ? - window.challengeType : - 0; + common.challengeType = common.challengeType || window.challengeType ? + window.challengeType : + 0; -common.challengeId = common.challengeId || window.challenge_Id; + common.challengeId = common.challengeId || window.challenge_Id; -common.challengeSeed = common.challengeSeed || window.challengeSeed ? - window.challengeSeed : - []; + common.challengeSeed = common.challengeSeed || window.challengeSeed ? + window.challengeSeed : + []; -common.seed = common.challengeSeed.reduce(function(seed, line) { - return seed + line + '\n'; -}, ''); + common.seed = common.challengeSeed.reduce(function(seed, line) { + return seed + line + '\n'; + }, ''); + + common.replaceScriptTags = function replaceScriptTags(value) { + return value + .replace(/'); + }; + + return common; +})(); // store code in the URL common.codeUri = (function(common, encode, decode, location, history) { + var replaceScriptTags = common.replaceScriptTags; + var replaceSafeTags = common.replaceSafeTags; var codeUri = { encode: function(code) { return encode(code); @@ -67,7 +85,7 @@ common.codeUri = (function(common, encode, decode, location, history) { null, location.href.split('?')[0] ); - location.hash = '#?' + query; + location.hash = '#?' + replaceScriptTags(query); } } else { query = location.hash.replace(/^\#\?/, ''); @@ -82,13 +100,15 @@ common.codeUri = (function(common, encode, decode, location, history) { var key = param.split('=')[0]; var value = param.split('=')[1]; if (key === 'solution') { - return codeUri.decode(value); + return replaceSafeTags(codeUri.decode(value || '')); } return solution; }, null); }, querify: function(solution) { - location.hash = '?solution=' + codeUri.encode(solution); + location.hash = '?solution=' + + codeUri.encode(replaceScriptTags(solution)); + return solution; } }; @@ -306,12 +326,6 @@ var sandBox = (function(jailed, codeOutput) { return sandBox; }(window.jailed, common.codeOutput)); -function replaceSafeTags(value) { - return value - .replace(/fccss/gi, ''); -} - var BDDregex = new RegExp( '(expect(\\s+)?\\(.*\\;)|' + '(assert(\\s+)?\\(.*\\;)|' + @@ -416,7 +430,7 @@ var editor = (function(CodeMirror, emmetCodeMirror, common) { common.seed; } - editor.setValue(replaceSafeTags(editorValue)); + editor.setValue(common.replaceSafeTags(editorValue)); editor.refresh(); }); @@ -659,7 +673,7 @@ function showCompletion() { } var resetEditor = function resetEditor() { - editor.setValue(replaceSafeTags(common.seed)); + editor.setValue(common.replaceSafeTags(common.seed)); $('#testSuite').empty(); bonfireExecute(true); common.codeStorage.updateStorage(); diff --git a/server/boot/user.js b/server/boot/user.js index a7c6fe2978..3d360f2776 100644 --- a/server/boot/user.js +++ b/server/boot/user.js @@ -11,6 +11,12 @@ const debug = debugFactory('freecc:boot:user'); const daysBetween = 1.5; const sendNonUserToMap = ifNoUserRedirectTo('/map'); +function replaceScriptTags(value) { + return value + .replace(/