Skip to content

Commit 5ff8d71

Browse files
kltmkltm
committed
manually cherrypick functional JS changes back into master; for #735 and #753 
1 parent 6778c5e commit 5ff8d71

File tree

2 files changed

+71
-6
lines changed

2 files changed

+71
-6
lines changed

‎js/NoctuaEditor.js

Lines changed: 10 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1845,8 +1845,11 @@ var MMEnvInit = function(model_json, in_relations, in_token){
18451845
annoton_eb_auto_args);
18461846
annoton_eb_auto.lite(true);
18471847
annoton_eb_auto.add_query_filter('document_category', 'ontology_class');
1848-
// Root is CHEBI:23367 ! molecular entity.
1849-
annoton_eb_auto.add_query_filter('regulates_closure', 'CHEBI:23367', ['*']);
1848+
// "Roots" are CHEBI:23367 and GO:0032991 for this case.
1849+
// See: https://github.com/geneontology/noctua/issues/753
1850+
//annoton_eb_auto.add_query_filter('regulates_closure', 'CHEBI:23367', ['*']);
1851+
annoton_eb_auto.set_extra('&fq=regulates_closure:"CHEBI:33695" OR regulates_closure:"GO:0032991"');
1852+
18501853
annoton_eb_auto.set_personality('ontology');
18511854

18521855
var annoton_mf_auto =
@@ -2081,9 +2084,11 @@ var MMEnvInit = function(model_json, in_relations, in_token){
20812084
simple_mf_free_enb_auto.lite(true);
20822085
simple_mf_free_enb_auto.add_query_filter('document_category',
20832086
'ontology_class');
2084-
// Root is CHEBI:23367 ! molecular entity.
2085-
simple_mf_free_enb_auto.add_query_filter('regulates_closure',
2086-
'CHEBI:23367', ['*']);
2087+
// "Roots" are CHEBI:23367 and GO:0032991 for this case.
2088+
// See: https://github.com/geneontology/noctua/issues/753
2089+
//simple_mf_free_enb_auto.add_query_filter('regulates_closure', 'CHEBI:23367', ['*']);
2090+
simple_mf_free_enb_auto.set_extra('&fq=regulates_closure:"CHEBI:33695" OR regulates_closure:"GO:0032991"');
2091+
20872092
simple_mf_free_enb_auto.set_personality('ontology');
20882093

20892094
var simple_mf_free_act_auto =

‎noctua.js

Lines changed: 61 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -57,6 +57,26 @@ function _tilde_expand_list(list){
5757
});
5858
}
5959

60+
61+
// Basic input sanitation to buffer input against XSS attempts. No
62+
// need for chevrons (i.e. tagged input) in our server-client universe
63+
// for now.
64+
var r1 = new RegExp("<", "g");
65+
var r2 = new RegExp(">", "g");
66+
var r3 = new RegExp("\\(", "g");
67+
var r4 = new RegExp("\\)", "g");
68+
function _sanitize(in_str){
69+
if( Object.prototype.toString.call(in_str)=== '[object String]' ){
70+
//console.log('PRE:: ' + in_str);
71+
in_str = in_str.replace(r1, "");
72+
in_str = in_str.replace(r2, "");
73+
in_str = in_str.replace(r3, "");
74+
in_str = in_str.replace(r4, "");
75+
//console.log('POST:: ' + in_str);
76+
}
77+
return in_str;
78+
}
79+
6080
// Aliases.
6181
var each = us.each;
6282
var what_is = bbop.what_is;
@@ -498,6 +518,28 @@ var NoctuaLauncher = function(){
498518
/// Response helper.
499519
///
500520

521+
// False, return true is something sanitized.
522+
self.sanitize_request = function(req){
523+
var ret = false;
524+
525+
var purgable = ['model_id',
526+
'individual_id',
527+
'subject_individual_id',
528+
'object_individual_id',
529+
'relation_id',
530+
'barista_token'];
531+
if( req && req.query ){
532+
533+
each(purgable, function(p){
534+
if( req.query[p] ){
535+
req.query[p] = _sanitize(req.query[p]);
536+
ret = true;
537+
}
538+
});
539+
}
540+
return ret;
541+
};
542+
501543
self.get_token = function(req){
502544
var ret = null;
503545
if( req && req.query && req.query['barista_token'] ){
@@ -807,6 +849,8 @@ var NoctuaLauncher = function(){
807849

808850
// Redirect to given workbench from root route.
809851
self.app.get('/', function(req, res) {
852+
self.sanitize_request(req);
853+
810854
// TODO: This workbench should be made a parameter.
811855
var landing_location = 'workbench/noctua-landing-page';
812856

@@ -822,6 +866,8 @@ var NoctuaLauncher = function(){
822866

823867
// Administration page (old landing).
824868
self.app.get('/admin', function(req, res) {
869+
self.sanitize_request(req);
870+
825871
// Grab markdown renderable file.
826872
var landing_raw = fs.readFileSync('./OVERVIEW.' + noctua_context + '.md').toString();
827873
var landing_md = md.markdown.toHTML(landing_raw);
@@ -857,6 +903,7 @@ var NoctuaLauncher = function(){
857903

858904
// General markdown documentation.
859905
self.app.get('/doc/:fname', function(req, res) {
906+
self.sanitize_request(req);
860907

861908
var final_content = '???';
862909
var fname = req.params['fname'] || '';
@@ -919,6 +966,7 @@ var NoctuaLauncher = function(){
919966

920967
//
921968
self.app.get('/basic/:model_type/:query', function(req, res) {
969+
self.sanitize_request(req);
922970

923971
// Try and see if we have an API token.
924972
var barista_token = self.get_token(req);
@@ -980,6 +1028,7 @@ var NoctuaLauncher = function(){
9801028
// This will skip cached templates.
9811029
if (ctype !== null) {
9821030
self.app.get('/' + thing, function(req, res) {
1031+
self.sanitize_request(req);
9831032

9841033
res.setHeader('Content-Type', ctype);
9851034
res.send(pup_tent.get(thing) );
@@ -1011,6 +1060,7 @@ var NoctuaLauncher = function(){
10111060
var fname = item[0];
10121061
var type = item[1];
10131062
self.app.get('/images/' + fname, function(req, res){
1063+
self.sanitize_request(req);
10141064
res.setHeader('Content-Type', 'image/' + type);
10151065
res.sendfile('static/' + fname);
10161066
});
@@ -1019,11 +1069,13 @@ var NoctuaLauncher = function(){
10191069
// TODO: This obviously does not do anything than supress some types
10201070
// of error messages.
10211071
self.app.get('/favicon.ico', function(req, res){
1072+
self.sanitize_request(req);
10221073
self.standard_response(res, 200, 'image/x-icon', '');
10231074
});
10241075

10251076
// Error redirect catch.
10261077
self.app.get('/error', function(req, res) {
1078+
self.sanitize_request(req);
10271079

10281080
console.log('caught intentional redirect for error report');
10291081

@@ -1053,6 +1105,7 @@ var NoctuaLauncher = function(){
10531105
///
10541106

10551107
self.app.get('/status', function(req, res) {
1108+
self.sanitize_request(req);
10561109

10571110
console.log('process heartbeat request');
10581111

@@ -1088,6 +1141,7 @@ var NoctuaLauncher = function(){
10881141
// Directly kick-to-edit an extant model--most things should
10891142
// pass through here.
10901143
self.app.get('/editor/graph/:query', function(req, res) {
1144+
self.sanitize_request(req);
10911145

10921146
monitor_internal_kicks = monitor_internal_kicks + 1;
10931147

@@ -1131,6 +1185,7 @@ var NoctuaLauncher = function(){
11311185
var injectable_css = wb['css'] || [];
11321186

11331187
self.app.get('/workbench/' + wbid, function(req, res){
1188+
self.sanitize_request(req);
11341189

11351190
monitor_internal_kicks = monitor_internal_kicks + 1;
11361191

@@ -1169,7 +1224,7 @@ var NoctuaLauncher = function(){
11691224
'subject_individual_id or' +
11701225
'object_individual_id or' +
11711226
'relation_id');
1172-
}
1227+
}
11731228
}else{
11741229
// TODO: Error.
11751230
}
@@ -1196,6 +1251,7 @@ var NoctuaLauncher = function(){
11961251
// DEBUG: A JSON model debugging tool for @hdietze
11971252
/// This path will eventually be destroyed.
11981253
self.app.post('/seed/json', function(req, res) {
1254+
self.sanitize_request(req);
11991255

12001256
monitor_internal_kicks = monitor_internal_kicks + 1;
12011257

@@ -1236,11 +1292,13 @@ var NoctuaLauncher = function(){
12361292

12371293
// Offer POST, not GET.
12381294
self.app.get('/tractorbeam', function(req, res){
1295+
self.sanitize_request(req);
12391296
tll('attempt to GET tractorbeam');
12401297
pre_fail(res, "no GET endpoint",
12411298
"try POST instead of GET at this URL");
12421299
});
12431300
self.app.post('/tractorbeam', function(req, res){
1301+
self.sanitize_request(req);
12441302

12451303
monitor_internal_kicks = monitor_internal_kicks + 1;
12461304

@@ -1580,6 +1638,7 @@ var NoctuaLauncher = function(){
15801638

15811639
// Test export handler.
15821640
self.app.post('/action/display', function(req, res) {
1641+
self.sanitize_request(req);
15831642

15841643
// Deal with incoming parameters.
15851644
var mstr = req.query['thing'] ||
@@ -1596,6 +1655,7 @@ var NoctuaLauncher = function(){
15961655

15971656
// Downloads for the impatient.
15981657
self.app.get('/download/:model/:format?', function(req, res){
1658+
self.sanitize_request(req);
15991659

16001660
monitor_internal_kicks = monitor_internal_kicks + 1;
16011661

0 commit comments

Comments
 (0)