Merge pull request #97 from Robot-Inventor/fix-prototype-pollution#96

プロトタイプ汚染脆弱性の修正 #96
Robot-Inventor · Mar 7, 2021 · 2d82825 · 2d82825
2 parents 10d21b8 + 5d5ded7
commit 2d82825
Show file tree

Hide file tree

Showing 4 changed files with 26 additions and 10 deletions.
diff --git a/changelog.md b/changelog.md
@@ -35,12 +35,20 @@ Edition: ORIZIN Agent HTML
 
 ## リリース
 
-### [v5.0.142.9dev-Eagle] - 2021-03-07
+### [v5.0.142.9dev-Eagle] - 2021-03-08
 
 #### 変更
 
 - HTMLファイルに直書きとなっていたCSSとJavaScriptを別ファイルに切り出しました　[#93](https://github.com/Robot-Inventor/ORIZIN-Agent-HTML/issues/93)
 
+#### セキュリティー
+
+- プロトタイプ汚染脆弱性を修正しました　[#96](https://github.com/Robot-Inventor/ORIZIN-Agent-HTML/issues/96)
+
+#### 修正
+
+- リファクタリングを行いました
+
 ### [v5.0.141.8-Eagle] - 2021-03-07
 
 #### 追加

diff --git a/resource/information.txt b/resource/information.txt
@@ -2,4 +2,4 @@ Series Name:ORIZIN Agent
 Edition:ORIZIN Agent HTML
 Version:v5.0.142.9dev
 Code Name:Eagle
-Date:2021-03-07 JST
+Date:2021-03-08 JST
diff --git a/resource/javascript/index.js b/resource/javascript/index.js
@@ -59,7 +59,7 @@ function add_chat(content, is_user = false, is_youtube = false) {
 }
 
 function chat_and_speak(chat_content, speak_content = "") {
- if (arguments[1] === undefined) {
+ if (speak_content === undefined) {
  speak_content = chat_content;
  }
  add_chat(chat_content);
@@ -132,7 +132,7 @@ async function read_setting() {
 }
 
 function listening_status(status = false) {
- if (arguments[0] !== undefined) {
+ if (status !== undefined) {
  if (status) {
  document.getElementById("listening_message").style.opacity = 1;
  document.getElementById("start_recognition").classList.add("listening");

diff --git a/resource/javascript/timer.js b/resource/javascript/timer.js
@@ -24,28 +24,36 @@ function update_time(time) {
 
 function timer_status() {
  if (is_stopped) {
- return "stopped"
+ return "stopped";
  } else {
- return "started"
+ return "started";
  }
 }
 
 function reset_status() {
  const result = is_reseted;
  is_reseted = false;
- return result
+ return result;
 }
 
 function set_time() {
  update_time(hour + ":" + minute + ":" + second);
 }
 
 window.addEventListener("load", () => {
- let settings = new Object;
+ let settings = {};
+ settings.h = 0;
+ settings.m = 0;
+ settings.s = 0;
+
  const pair = location.search.substring(1).split("&");
  for (var i = 0; pair[i]; i++) {
- var kv = pair[i].split("=");
- settings[kv[0]] = kv[1];
+ const kv = pair[i].split("=");
+
+ const name = kv[0];
+ const value = settings.hasOwnProperty(name) ? kv[1] : null;
+
+ settings[name] = value;
  }
  hour = settings.h;
  minute = settings.m;