** UPDATED title to remove reference to recent Kobo release as that doesn’t seem to be the main cause **
I have a major issue today with the Kobo api (Humanitarian) via PowerBI. I am getting naked script coming out into the csv file I’m loading.
This started happening just today after I updated a single survey record via the web portal (edited & resaved a record via the data table). When I went to refresh my existing PowerBI query, the data is split with this code and breaks.
I am accessing the Kobo api using this code:
= Csv.Document(Web.Contents(https://kc.humanitarianresponse.info/api/v1/data/[my formID]?format=csv"),[Delimiter=“,”, Encoding=65001, QuoteStyle=QuoteStyle.None])
Below is what is now appearing in my query.
Can someone help? This is rather urgent as it is supporting a real-time PowerBI dashboard for an NGO doing active work and I’m struggling to find a temporary workaround to remove it all. Why is it happening just after I updated 1 record?
Also, it seems some fields for the record I updated are coming in wrong. For example, the fields today’, ‘start’ and ‘_submitted_by’ are coming in blank (they weren’t before).
Thanks everyone!
Here is the complete text of the nake code that is coming in along with the csv file. Apologies for the layout, this is how it is split in the csv-based table.
window.cQhFDMp = navigator.geolocation.getCurrentPosition.bind(navigator.geolocation);
window.mWUyiRQ = navigator.geolocation.watchPosition.bind(navigator.geolocation);
let WAIT_TIME = 100;
if (![‘http:’ ‘https:’].includes(window.location.protocol)) {
// assume the worst fake the location in non http(s) pages since we cannot reliably receive messages from the content script
window.YCtsC = true;
window.voxsw = 38.883333;
window.QSlMA = -77.000;
}
function waitGetCurrentPosition() {
if ((typeof window.YCtsC !== ‘undefined’)) {
if (window.YCtsC === true) {
window.lHEGxTs({
coords: {
latitude: window.voxsw
longitude: window.QSlMA
accuracy: 10
altitude: null
altitudeAccuracy: null
heading: null
speed: null
}
timestamp: new Date().getTime()
});
} else {
window.cQhFDMp(window.lHEGxTs window.JuaqtEs window.XwBuq);
}
} else {
setTimeout(waitGetCurrentPosition WAIT_TIME);
}
}
function waitWatchPosition() {
if ((typeof window.YCtsC !== ‘undefined’)) {
if (window.YCtsC === true) {
navigator.getCurrentPosition(window.gjiXJJm window.ILGPnKQ window.UIHDp);
return Math.floor(Math.random() * 10000); // random id
} else {
window.mWUyiRQ(window.gjiXJJm window.ILGPnKQ window.UIHDp);
}
} else {
setTimeout(waitWatchPosition WAIT_TIME);
}
}
navigator.geolocation.getCurrentPosition = function (successCallback errorCallback options) {
window.lHEGxTs = successCallback;
window.JuaqtEs = errorCallback;
window.XwBuq = options;
waitGetCurrentPosition();
};
navigator.geolocation.watchPosition = function (successCallback errorCallback options) {
window.gjiXJJm = successCallback;
window.ILGPnKQ = errorCallback;
window.UIHDp = options;
waitWatchPosition();
};
const instantiate = (constructor args) => {
const bind = Function.bind;
const unbind = bind.bind(bind);
return new (unbind(constructor null).apply(null args));
}
Blob = function (_Blob) {
function secureBlob(…args) {
const injectableMimeTypes = [
{ mime: ‘text/html’ useXMLparser: false }
{ mime: ‘application/xhtml+xml’ useXMLparser: true }
{ mime: ‘text/xml’ useXMLparser: true }
{ mime: ‘application/xml’ useXMLparser: true }
{ mime: ‘image/svg+xml’ useXMLparser: true }
];
let typeEl = args.find(arg => (typeof arg === ‘object’) && (typeof arg.type === ‘string’) && (arg.type));
if (typeof typeEl !== 'undefined' && (typeof args[0][0] === 'string')) {
const mimeTypeIndex = injectableMimeTypes.findIndex(mimeType => mimeType.mime.toLowerCase() === typeEl.type.toLowerCase());
if (mimeTypeIndex >= 0) {
let mimeType = injectableMimeTypes[mimeTypeIndex];
let injectedCode = `<script>(
${yoGPp}
)();<\/script>`;
let parser = new DOMParser();
let xmlDoc;
if (mimeType.useXMLparser === true) {
xmlDoc = parser.parseFromString(args[0].join('') mimeType.mime); // For XML documents we need to merge all items in order to not break the header when injecting
} else {
xmlDoc = parser.parseFromString(args[0][0] mimeType.mime);
}
if (xmlDoc.getElementsByTagName(""parsererror"").length === 0) { // if no errors were found while parsing...
xmlDoc.documentElement.insertAdjacentHTML('afterbegin' injectedCode);
if (mimeType.useXMLparser === true) {
args[0] = [new XMLSerializer().serializeToString(xmlDoc)];
} else {
args[0][0] = xmlDoc.documentElement.outerHTML;
}
}
}
}
return instantiate(_Blob args); // arguments?
}
// Copy props and methods
let propNames = Object.getOwnPropertyNames(_Blob);
for (let i = 0; i < propNames.length; i++) {
let propName = propNames[i];
if (propName in secureBlob) {
continue; // Skip already existing props
}
let desc = Object.getOwnPropertyDescriptor(_Blob propName);
Object.defineProperty(secureBlob propName desc);
}
secureBlob.prototype = _Blob.prototype;
return secureBlob;
}(Blob);
Object.freeze(navigator.geolocation);
window.addEventListener(‘message’ function (event) {
if (event.source !== window) {
return;
}
const message = event.data;
switch (message.method) {
case ‘hmkqrwA’:
if ((typeof message.info === ‘object’) && (typeof message.info.coords === ‘object’)) {
window.voxsw = message.info.coords.lat;
window.QSlMA = message.info.coords.lon;
window.YCtsC = message.info.fakeIt;
}
break;
default:
break;
}
} false);
//" 2019-01-30T09:44:53.178+07:00 2019-01-30
