Avoid inline scripting for "javascript" email obfuscation method (sym…

…pa-community#1122)

src/lib/Sympa/HTMLDecorator.pm

@@ -295,19 +295,12 @@ sub decorate_email_js {
 sub _decorate_email_js {
     my $text = shift;
 
-    my @texts = map {
-        my $str = (defined $_) ? $_ : '';
-        $str =~ s/([\\\"])/\\$1/g;
-        $str =~ s/\r\n|\r|\n/\\n/g;
-        $str =~ s/\t/\\t/g;
-        $str;
+    return join '', map {
+        my @chars = split //, $_;
+        sprintf '<span class="decoText" data-text="%s">%s</span>',
+            join(',', map { ord $_ } @chars),
+            '*' x scalar @chars;
     } split /\b|(?=\@)|(?<=\@)/, $text;
-    return
-          sprintf '<script type="text/javascript">' . "\n" . '<!--' . "\n"
-        . 'document.write(%s)' . "\n"
-        . '// -->' . "\n"
-        . '</script>',
-        join(" +\n", map { '"' . $_ . '"' } @texts);
 }
 
 1;

www/js/sympa.js

@@ -315,3 +315,23 @@ $(function() {
     });
 });
 
+$(function() {
+    $('span.decoText').each(function(){
+        var elm = $(this);
+        try {
+            var chars = String(elm.data('text')).split(',').map(
+                function(val) {
+                    if (isNaN(val)) {
+                        throw new Error('Non-numeric data');
+                    }
+                    return val.toString(10);
+                }
+            );
+            elm.text(String.fromCharCode.apply(null, chars));
+        } catch(e) {
+            return false;
+        }
+        return true;
+    });
+});
+