Spartan/wiki
1
0
Fork 0
mirror of https://github.com/requarks/wiki.git synced 2025-02-25 18:55:30 -06:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request from GHSA-xjcj-p2qv-q3rf

Browse Source 
* Update render.js

# Improved handling of mustache expressions and v-pre attribute assignment

## Changes Made:
- Ensured that the parent tag of such text nodes is explicitly set to a `<p>` tag with the `v-pre` attribute.
- Added debug messages for better understanding of the script execution flow [THIS SHOULD REMOVED WHEN PUSHING TO PRODUCTION].

## Why it Works:
- When a mustache expression is found, the script either wraps it in a new `<p>` tag with the `v-pre` attribute or adds the `v-pre` attribute to the existing parent `<p>` tag.
- This approach ensures that the template code is not removed but encapsulated within `<p>` tags with the `v-pre` attribute, as required.

## Test Cases Passed:
1. `<xyz>{{ constructor.constructor('alert(1)')() }}</xyz>`
2. `<xyz>{{ constructor.constructor('alert(1)')() }}</xyz>`
3. `<p><xyz>{{ constructor.constructor('alert(1)')() }}</p>`
4. `<p><xyz>{{ constructor.constructor('alert(1)')() }}</xyz></p>`
5. `<p>&lt;xyz&gt;{{constructor.constructor('alert("Test Case 8")')()}}&lt;xyz&gt;{{constructor.constructor('alert("Test Case 9")')()}}&lt;/xyz&gt;</p>`

This commit enhances the robustness and reliability of handling mustache expressions and ensures proper assignment of the `v-pre` attribute, to ensure that there is no room for the weaponization of the template code later in the rendering process.

* fix: move template expressions after dom-purify + handle text nodes without parent

---------

Co-authored-by: NGPixel <github@ngpixel.com>
This commit is contained in:
Ethan 2024-05-13 20:57:17 +02:00 committed by GitHub
parent 98c04fe18e
commit 1238d614e1
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
1 changed files with 23 additions and 16 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

37
server/modules/rendering/html-core/renderer.js
View File

@ -10,7 +10,7 @@ const mustacheRegExp = /(\{|&#x7b;?){2}(.+?)(\}|&#x7d;?){2}/i
module.exports = {
async render() {
const $ = cheerio.load(this.input, {
let $ = cheerio.load(this.input, {
decodeEntities: true
})
@ -253,18 +253,36 @@ module.exports = {
}
})
// --------------------------------
// STEP: POST
// --------------------------------
let output = decodeEscape($.html('body').replace('<body>', '').replace('</body>', ''))
for (let child of _.sortBy(_.filter(this.children, ['step', 'post']), ['order'])) {
const renderer = require(`../${_.kebabCase(child.key)}/renderer.js`)
output = await renderer.init(output, child.config)
}
// --------------------------------
// Escape mustache expresions
// --------------------------------
$ = cheerio.load(output, {
decodeEntities: true
})
function iterateMustacheNode (node) {
const list = $(node).contents().toArray()
list.forEach(item => {
$(node).contents().each((idx, item) => {
if (item && item.type === 'text') {
const rawText = $(item).text().replace(/\r?\n|\r/g, '')
if (mustacheRegExp.test(rawText)) {
if (!item.parent || item.parent.name === 'body') {
$(item).wrap($('<p>').attr('v-pre', true))
} else {
$(item).parent().attr('v-pre', true)
}
}
} else {
iterateMustacheNode(item)
}
@ -276,18 +294,7 @@ module.exports = {
$(elm).attr('v-pre', true)
})
// --------------------------------
// STEP: POST
// --------------------------------
let output = decodeEscape($.html('body').replace('<body>', '').replace('</body>', ''))
for (let child of _.sortBy(_.filter(this.children, ['step', 'post']), ['order'])) {
const renderer = require(`../${_.kebabCase(child.key)}/renderer.js`)
output = await renderer.init(output, child.config)
}
return output
return decodeEscape($.html('body').replace('<body>', '').replace('</body>', ''))
}
}