@@ -215,11 +215,13 @@ protected static boolean isXSSMode(String url) {
215215 * @param url
216216 * @return
217217 * @j2sNative
218- * return net.sf.j2s.ajax.SimpleRPCRequest.isXSSMode(url, true);
218+ * return window["j2s.disable.subdomain.xss"] != true
219+ * && net.sf.j2s.ajax.SimpleRPCRequest.isXSSMode(url, true);
219220 */
220221 protected static boolean isSubdomain (String url ) {
221222 return false ;
222223 }
224+
223225 /**
224226 * Check cross site script. Only make senses for JavaScript.
225227 *
@@ -290,9 +292,32 @@ protected static boolean checkXSS(String url, String serialize, SimpleRPCRunnabl
290292 return false ;
291293 }
292294
293- static void callByScript (String rnd , String length , String i , String content ) {
294- /**
295- * @j2sNative
295+ /**
296+ * Clean up SCRIPT element's event handlers.
297+ * @param scriptObj
298+ * @return whether the SCRIPT element is already OK to clean up.
299+ * @j2sNative
300+ var userAgent = navigator.userAgent.toLowerCase ();
301+ var isOpera = (userAgent.indexOf ("opera") != -1);
302+ var isIE = (userAgent.indexOf ("msie") != -1) && !isOpera;
303+ if (isIE) {
304+ var done = false;
305+ var state = "" + scriptObj.readyState;
306+ if (state == "loaded" || state == "complete") {
307+ scriptObj.onreadystatechange = null;
308+ done = true;
309+ }
310+ return done;
311+ } else {
312+ scriptObj.onerror = null;
313+ scriptObj.onload = null;
314+ return true;
315+ }
316+ */
317+ native static boolean cleanUp (Object scriptObj ); // for JavaScript only
318+
319+ /**
320+ * @j2sNative
296321var g = net.sf.j2s.ajax.SimpleRPCRequest;
297322var runnable = g.idSet["o" + rnd];
298323if (runnable == null) return;
@@ -305,43 +330,28 @@ static void callByScript(String rnd, String length, String i, String content) {
305330script.type = "text/javascript";
306331script.src = url + "?jzn=" + rnd + "&jzp=" + length
307332 + "&jzc=" + (i + 1) + "&jzz=" + content;
333+ var fun = function () {
334+ if (window["net"] != null && !net.sf.j2s.ajax.SimpleRPCRequest.cleanUp(this)) {
335+ return; // IE, not completed yet
336+ }
337+ var idx = this.src.indexOf ("jzn=");
338+ var rid = this.src.substring (idx + 4, this.src.indexOf ("&", idx));
339+ net.sf.j2s.ajax.SimpleRPCRequest.xssNotify (rid, null);
340+ document.getElementsByTagName ("HEAD")[0].removeChild (this);
341+ };
308342var userAgent = navigator.userAgent.toLowerCase ();
309343var isOpera = (userAgent.indexOf ("opera") != -1);
310344var isIE = (userAgent.indexOf ("msie") != -1) && !isOpera;
311345if (typeof (script.onreadystatechange) == "undefined" || !isIE) { // W3C
312- script.onerror = function () {
313- this.onerror = null;
314- var idx = this.src.indexOf ("jzn=");
315- var rid = this.src.substring (idx + 4, this.src.indexOf ("&", idx));
316- net.sf.j2s.ajax.SimpleRPCRequest.xssNotify (rid, null);
317- document.getElementsByTagName ("HEAD")[0].removeChild (this);
318- };
319- script.onload = function () {
320- this.onload = null;
321- if (navigator.userAgent.indexOf ("Opera") >= 0) {
322- var idx = this.src.indexOf ("jzn=");
323- var rid = this.src.substring (idx + 4, this.src.indexOf ("&", idx));
324- net.sf.j2s.ajax.SimpleRPCRequest.xssNotify (rid, null);
325- }
326- document.getElementsByTagName ("HEAD")[0].removeChild (this);
327- };
346+ script.onerror = script.onload = fun;
328347} else { // IE
329348 script.defer = true;
330- script.onreadystatechange = function () {
331- var state = "" + this.readyState;
332- if (state == "loaded" || state == "complete") {
333- this.onreadystatechange = null;
334- var idx = this.src.indexOf ("jzn=");
335- var rid = this.src.substring (idx + 4, this.src.indexOf ("&", idx));
336- net.sf.j2s.ajax.SimpleRPCRequest.xssNotify (rid, null);
337- document.getElementsByTagName ("HEAD")[0].removeChild (this);
338- }
339- };
349+ script.onreadystatechange = fun;
340350}
341351var head = document.getElementsByTagName ("HEAD")[0];
342352head.appendChild (script);
343- */ {}
344- }
353+ */
354+ native static void callByScript ( String rnd , String length , String i , String content );
345355
346356 /**
347357 * Cross site script notify. Only make senses for JavaScript.
0 commit comments