Merge pull request #253 from cubedro/master

Update from master

src/js/controllers.js

@@ -133,6 +133,9 @@ netStatsApp.controller('StatsCtrl', function($scope, $filter, $localStorage, soc
 
 	function socketAction(action, data)
 	{
+		// filter data
+		data = xssFilter(data);
+
 		// console.log('Action: ', action);
 		// console.log('Data: ', data);
 
@@ -142,6 +145,7 @@ netStatsApp.controller('StatsCtrl', function($scope, $filter, $localStorage, soc
 				$scope.nodes = data;
 
 				_.forEach($scope.nodes, function (node, index) {
+
 					// Init hashrate
 					if( _.isUndefined(node.stats.hashrate) )
 						node.stats.hashrate = 0;
@@ -633,4 +637,18 @@ netStatsApp.controller('StatsCtrl', function($scope, $filter, $localStorage, soc
 			node.readable.latency = node.stats.latency + ' ms';
 		}
 	}
+
+	// very simple xss filter
+	function xssFilter(obj){
+		if(_.isArray(obj)) {
+			return _.map(obj, xssFilter);
+
+		} else if(_.isObject(obj)) {
+			return _.mapValues(obj, xssFilter);
+
+		} else if(_.isString(obj)) {
+			return obj.replace(/\< *\/* *script *>*/gi,'').replace(/javascript/gi,'');
+		} else
+			return obj;
+	}
 });