Files
computer-playbook/roles/web-app-docs/files/javascript/languages.js
T
kevinveenbirkenbachandClaude Opus 5.5 6e045bced8 fix(web-app-docs): encode line breaks in redirects, navigate by built URLs
- py/http-response-splitting (server.py:87): _redirect percent-encodes CR
  and LF in the Location header
- js/xss-through-dom (versions.js:82, languages.js:25): both switchers
  navigate to the URL they built instead of select.value

The new cases in test_server.py, versions.test.js and languages.test.js
fail without the fix and pass with it.

🎯 Fix: 92 %
💥 Break: 3 %
💸 Cost: –
⏱️ Time: –
🛡️ Security: 100 %
🏆 Score: 89
🚦 Gate: ✅ 90/5, cost and time <= 100, security 100 %

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2026-11-05 16:54:27 +00:00

34 lines
1.1 KiB
JavaScript

(function () {
function pageUrl(version, code, page) {
const prefix = code === "en" ? `/${version}` : `/${version}/${code}`;
return page ? `${prefix}/${page}.html` : `${prefix}/`;
}
async function fill(select) {
const { version, language, page } = select.dataset;
const response = await fetch(`/api/languages/${encodeURIComponent(version)}`);
if (!response.ok) {
return;
}
const { languages } = await response.json();
const urls = languages.map((entry) => pageUrl(version, entry.code, page));
select.replaceChildren(
...languages.map((entry, index) => {
const option = document.createElement("option");
option.value = urls[index];
option.textContent = entry.native;
option.lang = entry.code;
option.selected = entry.code === language;
return option;
}),
);
select.addEventListener("change", () => {
window.location.href = urls[select.selectedIndex];
});
}
document.addEventListener("DOMContentLoaded", () => {
document.querySelectorAll(".docs-language-switcher").forEach(fill);
});
})();