From 3baa93048be6066281e5d0cdf254d1857b2ab834 Mon Sep 17 00:00:00 2001
From: catborise <catborise@gmail.com>
Date: Thu, 5 Nov 2026 12:12:21 +0300
Subject: [PATCH] chore(deps): a list's search is kept in sessionStorage,
 without js-cookie

js-cookie served only table_filter.js, which kept a list's search in a
cookie for a day; the cookie went to the server with every request.
The search is now kept in the tab's sessionStorage: it stays across
reloads and pages in that tab, a new tab starts empty, and the server
never sees it. The library goes.
---
 instances/tests/test_xss.py |  2 +-
 static/js/js.cookie.js      |  2 --
 static/js/table_filter.js   | 25 +++++++++++++++++++++----
 templates/base.html         |  2 --
 4 files changed, 22 insertions(+), 9 deletions(-)
 delete mode 100644 static/js/js.cookie.js

diff --git a/instances/tests/test_xss.py b/instances/tests/test_xss.py
index 459d8e0d..a3061bb7 100644
--- a/instances/tests/test_xss.py
+++ b/instances/tests/test_xss.py
@@ -134,7 +134,7 @@ class TemplateHtmlConcatenationTestCase(TestCase):
 # has to be reviewed (use .text() / .val() / DOM APIs for server data instead).
 HTML_SINK = re.compile(r"""\.html\(|innerHTML\s*=|append\(\s*['"]<""")
 # the libraries kept as published, not the app's scripts
-VENDORED_SCRIPTS = {"jquery.js", "js.cookie.js", "socket.io.js"}
+VENDORED_SCRIPTS = {"jquery.js", "socket.io.js"}
 ALLOWED_HTML_SINKS = {
     ("static/js/instance_page.js", "hostDevices.innerHTML = html;"): "the panel's own fragment, host_devices_form.html, escaped by Django",
     ("static/js/instance_page.js", "migratePlan.innerHTML = html;"): "the panel's own fragment, migrate_plan.html, escaped by Django",
diff --git a/static/js/js.cookie.js b/static/js/js.cookie.js
deleted file mode 100644
index a5d37e23..00000000
--- a/static/js/js.cookie.js
+++ /dev/null
@@ -1,2 +0,0 @@
-/*! js-cookie v3.0.8 | MIT */
-!function(e,t){"object"==typeof exports&&"undefined"!=typeof module?module.exports=t():"function"==typeof define&&define.amd?define(t):(e="undefined"!=typeof globalThis?globalThis:e||self,function(){var n=e.Cookies,o=e.Cookies=t();o.noConflict=function(){return e.Cookies=n,o}}())}(this,(function(){"use strict";function e(e){for(var t=1;t<arguments.length;t++){var n=arguments[t];for(var o in n)"__proto__"!==o&&(e[o]=n[o])}return e}var t=function t(n,o){function r(t,r,i){if("undefined"!=typeof document){"number"==typeof(i=e({},o,i)).expires&&(i.expires=new Date(Date.now()+864e5*i.expires)),i.expires&&(i.expires=i.expires.toUTCString()),t=encodeURIComponent(t).replace(/%(2[346B]|5E|60|7C)/g,decodeURIComponent).replace(/[()]/g,escape);var c="";for(var u in i)i[u]&&(c+="; "+u,!0!==i[u]&&(c+="="+i[u].split(";")[0]));return document.cookie=t+"="+n.write(r,t)+c}}return Object.create({set:r,get:function(e){if("undefined"!=typeof document&&(!arguments.length||e)){for(var t=document.cookie?document.cookie.split("; "):[],o={},r=0;r<t.length;r++){var i=t[r].split("="),c=i.slice(1).join("=");try{var u=decodeURIComponent(i[0]);if(u in o||(o[u]=n.read(c,u)),e===u)break}catch(e){}}return e?o[e]:o}},remove:function(t,n){r(t,"",e({},n,{expires:-1}))},withAttributes:function(n){return t(this.converter,e({},this.attributes,n))},withConverter:function(n){return t(e({},this.converter,n),this.attributes)}},{attributes:{value:Object.freeze(o)},converter:{value:Object.freeze(n)}})}({read:function(e){return'"'===e[0]&&(e=e.slice(1,-1)),e.replace(/(%[\dA-F]{2})+/gi,decodeURIComponent)},write:function(e){return encodeURIComponent(e).replace(/%(2[346BF]|3[AC-F]|40|5[BDE]|60|7[BCD])/g,decodeURIComponent)}},{path:"/"});return t}));
diff --git a/static/js/table_filter.js b/static/js/table_filter.js
index f839a170..90e4d3d3 100644
--- a/static/js/table_filter.js
+++ b/static/js/table_filter.js
@@ -68,12 +68,29 @@ if (typeof module !== "undefined") {
 } else {
     var search = document.getElementById("filter");
     var states = document.getElementById("state-filter");
-    // a form's search ([data-forget], the group form's members) starts empty
+    // a list's search is kept for this tab, in the browser only; a form's
+    // search ([data-forget], the group form's members) starts empty
     var remember = !search.hasAttribute("data-forget");
-    search.value = remember && Cookies.get(document.title + "_filter") || "";
+    var key = document.title + "_filter";
+    function keep(value) {
+        try {
+            if (value) {
+                sessionStorage.setItem(key, value);
+            } else {
+                sessionStorage.removeItem(key);
+            }
+        } catch (e) {
+            // storage turned off: the search is not kept
+        }
+    }
+    try {
+        search.value = remember && sessionStorage.getItem(key) || "";
+    } catch (e) {
+        search.value = "";
+    }
     search.addEventListener("input", function () {
         if (remember) {
-            Cookies.set(document.title + "_filter", search.value, {expires: 1});
+            keep(search.value);
         }
         filterTable(document);
     });
@@ -103,7 +120,7 @@ if (typeof module !== "undefined") {
     if (clear) {
         clear.addEventListener("click", function () {
             search.value = "";
-            Cookies.remove(document.title + "_filter");
+            keep("");
             if (pills) {
                 chooseState(pills.querySelector('[data-pill-state=""]'));
             } else if (states) {
diff --git a/templates/base.html b/templates/base.html
index f1cedc85..12c6d2da 100644
--- a/templates/base.html
+++ b/templates/base.html
@@ -77,8 +77,6 @@
     <!-- Bootstrap Core JavaScript -->
     <script src="{% static 'js/bootstrap.bundle.min.js' %}"></script>
     <script src="{% static 'js/confirm_dialog.js' %}"></script>
-    <!-- JavaScript Cookie -->
-    <script src="{% static 'js/js.cookie.js' %}"></script>
     <!-- Table sorting -->
     <script src="{% static 'js/tablesort.min.js' %}"></script>
     <script src="{% static 'js/tablesort.number.min.js' %}"></script>