From 275a875810e01e573b4cd22660104032b8328f88 Mon Sep 17 00:00:00 2001
From: liujing <liujing@rongkecloud.com>
Date: Thu, 10 Aug 2017 11:17:31 +0800
Subject: [PATCH] =?UTF-8?q?=E5=A2=9E=E5=8A=A0xss=E6=96=B9=E6=B3=95?=
 =?UTF-8?q?=EF=BC=8C=E6=9E=84=E5=BB=BAoption=E6=97=B6=E8=BD=AC=E4=B9=89?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 js/jquery.cxselect.js | 31 ++++++++++++++++++++++++++++---
 1 file changed, 28 insertions(+), 3 deletions(-)

diff --git a/js/jquery.cxselect.js b/js/jquery.cxselect.js
index d1ea17f..00a3e0d 100644
--- a/js/jquery.cxselect.js
+++ b/js/jquery.cxselect.js
@@ -71,6 +71,31 @@
     return data;
   };
 
+  /**
+   * 
+   * xss 转义
+   * @param {string} str
+   * 需要转义的字符串
+   * @return
+   * 转义之后的字符串
+   */
+  cxSelect.xss = function (str) {
+    if (typeof str == 'string') {
+      str = str
+        .replace(/&/g, '&amp;')
+        .replace(/</g, '&lt;')
+        .replace(/>/g, '&gt;')
+        .replace(/\r\n/g, '<br>')
+        .replace(/\n/g, '<br>')
+        .replace(/\s/g, '&nbsp;')
+        .replace(/"/g, '&quot;')
+        .replace(/'/g, '&apos;');
+      return str;
+    } else {
+      return str + '';
+    }
+  }
+
   cxSelect.init = function(dom, settings) {
     var self = this;
 
@@ -313,7 +338,7 @@
 
     if (!$.isArray(data)) {return};
 
-    var _html = !_required ? '<option value="' + String(_firstValue) + '">' + String(_firstTitle) + '</option>' : '';
+    var _html = !_required ? '<option value="' + String(_firstValue) + '">' + cxSelect.xss(String(_firstTitle)) + '</option>' : '';
 
     // 区分标题、值的数据
     if (typeof _jsonName === 'string' && _jsonName.length) {
@@ -323,13 +348,13 @@
       };
 
       for (var i = 0, l = data.length; i < l; i++) {
-        _html += '<option value="' + String(data[i][_jsonValue]) + '">' + String(data[i][_jsonName]) + '</option>';
+        _html += '<option value="' + String(data[i][_jsonValue]) + '">' +  cxSelect.xss(String(data[i][_jsonName])) + '</option>';
       };
 
     // 数组即为值的数据
     } else {
       for (var i = 0, l = data.length; i < l; i++) {
-        _html += '<option value="' + String(data[i]) + '">' + String(data[i]) + '</option>';
+        _html += '<option value="' + String(data[i]) + '">' +  cxSelect.xss(String(data[i])) + '</option>';
       };
     };