We take the simple/cheap way out and use ExtJS htmlEncode on all
entry points for this.
This is still mostly limited to 'doing it to yourself'.
The main fix is in app/view/main/Main.js where the title is rendered
out, and will apparently execute arbitrary javascript within a title
tag(!). This is an ExtJS thing, apparently, so we make it
unconditionally encode it to render on the bar.
Apparently this isn't the only place arbitrary execution can occur,
so just be safe(r).
Just make the checkboxes uneditable until after the service is
actually created. I consider this a bad usability issue, but
am having trouble getting ExtJS to allow any access to the
necessary information while a service is being created.
commit.
NOTE: If you query window.setTimeout for timer granularity, or
EventTarget.prototype.addEventListener for passive listeners,
for a particular ap in the dev console and it says 'native code',
it's disabled.
We now default to passive event listeners on all services,
as well as 100ms minimum granularity on setTimeout.
This is because many of the web-wrapped services constantly fire
totally unnecessary repaint events as fast as they can,
as well as actively listening for mouse events which also cause
unnecessary reflow.
On my machine, this cuts the CPU usage by ~70% while not affecting
the usability of any services.
There's a user-toggle available there. There's not a per-service
option for the ServiceList because it shouldn't affect anything
except in truly abnormal cases. If there needs to be one, we can add
it.
We've completely overhauled badge updates by introducing
a callable function which should cover the standard case.
We also allow separate custom JS and JS just for badge updates.
We also make the service editing box taller by default.
We fix the logging for injected stuff to actually remain accurate.
And replace each js_unread in each service with modernized version.
We allow for separate custom badge updates and custom JS to
avoid doing unnecessary title event hooking allow overrides in a
sensible order.
Also remove Yahoo messenger service, as it was shutdown earlier in
July.
Remove the option to "toggle" it from the menu, because it never did
anything when set to always on, and it'd never be useful to close it
from there as opposed to the "x", which also doesn't work with
"always on".
You'll have to deselect "always on status bar" for your already existing
services.
Closes#15
Most users will use the default values and will therefore have an insecure setup.
The result can be Man-in-the-Middle or other attacks on rambox users when using default settings!
TheGoddessInari
madblobfish
Ramiro Saenz
Michael Weimann