Felix Rudolphi issues

Results 5 issues of


                                            Felix Rudolphi

Use of eval("new "+className+"()") allows XSS when JSON is unmarshalled

Imagine className could be "String();doWhatever" Better create a function to create the instances. Split the class name at dots, then go var base=window; base=base["first"]; and so on to get the...

draw2d.command.CommandRotate distorts objects

When updating the dimensions, width and height parameters are swapped. draw2d/src/command/CommandRotate.js:82 should be this.figure.setDimension(w, h)

Properties of Locators are not serialized or cloned

Proposed fix in draw2d.layout.locator.Locator: clone: function () { let clone = eval("new " + this.NAME + "();") clone.attr(this.attr()) // also clone properties return clone } (will not work if the...

Children of nodes are not serialized to JSON

Proposed fix in draw2d/src/shape/node/Node.js: getPersistentAttributes: function () { let memento = this._super() // ... memento.children = [] this.children.each(function (i, child) { // getChildren() misses the locator memento.children.push(extend(child.figure.getPersistentAttributes(), { // no...

Ports are broken for draw2d.shape.analog.* after serialize/deserialize to JSON

As no class name for the custom MyInputPortLocator/MyOutputPortLocator subclasses is serialized, only dummy "Class.extend" objects are created during deserialization. The probably best solution would be to just serialize the node...