Add protection against malicious code in font loader.

2012-03-20 17:56:42 +02:00 · 2012-03-20 17:56:42 +02:00 · ed2bcf0ffa
commit ed2bcf0ffa
parent eb4ec7899a
1 changed files with 6 additions and 1 deletions
--- a/src/fonts.js
+++ b/src/fonts.js
@ -494,9 +494,14 @@ var FontLoader = {
      // 82402.

      // Validate the names parameter -- the values can used to construct HTML.
-      if (!/^\w+$/.test(names.join('')))
+      if (!/^\w+$/.test(names.join(''))) {
        error('Invalid font name(s): ' + names.join());

+        // Normally the error-function throws. But if a malicious code
+        // intercepts the function call then the return is needed.
+        return;
+      }
+
      var div = document.createElement('div');
      div.setAttribute('style',
                       'visibility: hidden;' +