fixed an xss issue in client-side scripting

Author: michaelschwarz

AjaxPro/Utilities/Constant.cs

@@ -52,6 +52,6 @@ public sealed class Constant
         /// <summary>
 		/// The assembly version.
 		/// </summary>
-        public const string AssemblyVersion = "21.12.8.1";
+        public const string AssemblyVersion = "21.12.21.1";
 	}
 }

AjaxPro/core.js

@@ -174,29 +174,36 @@ Object.extend(AjaxPro, {
 	queue: null,
 	noUtcTime: false,
 	regExDate: function (str, p1, p2, offset, s) {
-		str = str.substring(1).replace('"', '');
-		var date = str;
-
-		if (str.substring(0, 7) == "\\\/Date(") {
-			str = str.match(/Date\((.*?)\)/)[1];
-			date = "new Date(" + parseInt(str) + ")";
+		var date = str.substring(1).replace('"', '');
+		if (date.substring(0, 7) == "\\\/Date(") {
+			var d = date.match(/Date\((.*?)\)/)[1];
+			return "new Date(" + parseInt(d) + ")";
 		}
 		else { // ISO Date 2007-12-31T23:59:59Z                                     
-			var matches = str.split(/[-,:,T,Z]/);
-			matches[1] = (parseInt(matches[1], 0) - 1).toString();
-			date = "new Date(Date.UTC(" + matches.join(",") + "))";
+			var matches = date.split(/[-,:,T,Z]/);
+			if (matches.length == 7) {
+				matches[1] = (parseInt(matches[1], 0) - 1).toString();
+				var isDate = true;
+				for (var i = 0; i < matches.length; i++) {
+					if (isNaN(parseInt(matches[i], 10))) {
+						isDate = false;
+						break;
+                    }
+				}
+				if (isDate) {
+					return "new Date(Date.UTC(" + matches.join(",") + "))";
+				}
+			}
 		}
-		return date;
+		return str;
 	},
 	parse: function (text) {
 		// not yet possible as we still return new type() JSON
 		//		if (!(!(/[^,:{}\[\]0-9.\-+Eaeflnr-u \n\r\t]/.test(
 		//		text.replace(/"(\\.|[^"\\])*"/g, '')))  ))
 		//			throw new Error("Invalid characters in JSON parse string.");                 
-
 		var regEx = /(\"\d{4}-\d{2}-\d{2}T\d{2}:\d{2}.*?\")|(\"\\\/Date\(.*?\)\\\/")/g;
 		text = text.replace(regEx, this.regExDate);
-
 		return eval('(' + text + ')');
 	},
 	m: {
@@ -239,25 +246,6 @@ Object.extend(AjaxPro, {
 			}
 			return "[" + v.join(",") + "]";
 		} else if (c == Date) {
-			//			var d = {};
-			//			d.__type = "System.DateTime";
-			//			if(AjaxPro.noUtcTime == true) {
-			//				d.Year = o.getFullYear();
-			//				d.Month = o.getMonth() +1;
-			//				d.Day = o.getDate();
-			//				d.Hour = o.getHours();
-			//				d.Minute = o.getMinutes();
-			//				d.Second = o.getSeconds();
-			//				d.Millisecond = o.getMilliseconds();
-			//			} else {
-			//				d.Year = o.getUTCFullYear();
-			//				d.Month = o.getUTCMonth() +1;
-			//				d.Day = o.getUTCDate();
-			//				d.Hour = o.getUTCHours();
-			//				d.Minute = o.getUTCMinutes();
-			//				d.Second = o.getUTCSeconds();
-			//				d.Millisecond = o.getUTCMilliseconds();
-			//			}
 			return AjaxPro.toJSON("/Date(" + new Date(Date.UTC(o.getUTCFullYear(), o.getUTCMonth(), o.getUTCDate(), o.getUTCHours(), o.getUTCMinutes(), o.getUTCSeconds(), o.getUTCMilliseconds())).getTime() + ")/");
 		}
 		if (typeof o.toJSON == "function") {