Perforce 2013.1 Javascript API for Visual Tools

Security
If you must use innerHTML, escape the data that you are adding. For example:
function escapeHTML(html) {
var div = document.createElement('div');
var text = document.createTextNode(html);
div.appendChild(text);
return div.innerHTML;
}
The following example illustrates how you escape methods.
var result = P4JsApi.p4("some_p4_command");
var data = result.data[0]; // data is a string
// Example data that can cause attacks
var data1 = '';
var data2 = "test data here" ;
var data3 = "alert('victim file obliterated')";
// Rule: 1
var displayTextDiv=document.getElementById("display text");
displayTextDiv.innerHTML = data1; // insecure
displayTextDiv.innerHTML = P4JsApi.encodeForHtml(data1); // secure
// Rule: 2
var inputTag = document.getElementById("textBox");
inputTag.setAttribute("value", data2); // insecure
inputTag.setAttribute("value",
P4JsApi.encodeForHTMLAttribute(data2)); // secure
// Rule: 3
var errorImgTag = document.getElementById("errorImg");
errorImgTag.setAttribute("onError", data3); // insecure
errorImgTag.setAttribute("onError",
P4JsApi.encodeForJavaScript(data3)); // secure
26 Perforce 2013.1 JavaScript API for Visual Tools