dea243f2eb
There is no actual vulnerability in the existing implementation, as we can only fetch existing elements (no DOM injection is possible). Plus, the only call occurring on those elements is `HTMLElement#focus`. Consider this an extra, more future-proof precaution.
26 lines
743 B
JavaScript
26 lines
743 B
JavaScript
( function() {
|
|
var is_webkit = navigator.userAgent.toLowerCase().indexOf( 'webkit' ) > -1,
|
|
is_opera = navigator.userAgent.toLowerCase().indexOf( 'opera' ) > -1,
|
|
is_ie = navigator.userAgent.toLowerCase().indexOf( 'msie' ) > -1;
|
|
|
|
if ( ( is_webkit || is_opera || is_ie ) && document.getElementById && window.addEventListener ) {
|
|
window.addEventListener( 'hashchange', function() {
|
|
var id = location.hash.substring( 1 ),
|
|
element;
|
|
|
|
if ( ! /^[A-z0-9_-]+$/.test( id ) ) {
|
|
return;
|
|
}
|
|
|
|
element = document.getElementById( id );
|
|
|
|
if ( element ) {
|
|
if ( ! /^(?:a|select|input|button|textarea)$/i.test( element.tagName ) ) {
|
|
element.tabIndex = -1;
|
|
}
|
|
|
|
element.focus();
|
|
}
|
|
}, false );
|
|
}
|
|
})();
|