Skip to content
Snippets Groups Projects
  1. May 24, 2024
  2. May 13, 2024
    • Ethan's avatar
      Merge pull request from GHSA-xjcj-p2qv-q3rf · 1238d614
      Ethan authored
      
      * Update render.js
      
      # Improved handling of mustache expressions and v-pre attribute assignment
      
      ## Changes Made:
      - Ensured that the parent tag of such text nodes is explicitly set to a `<p>` tag with the `v-pre` attribute.
      - Added debug messages for better understanding of the script execution flow [THIS SHOULD REMOVED WHEN PUSHING TO PRODUCTION].
      
      ## Why it Works:
      - When a mustache expression is found, the script either wraps it in a new `<p>` tag with the `v-pre` attribute or adds the `v-pre` attribute to the existing parent `<p>` tag.
      - This approach ensures that the template code is not removed but encapsulated within `<p>` tags with the `v-pre` attribute, as required.
      
      ## Test Cases Passed:
      1. `<xyz>{{ constructor.constructor('alert(1)')() }}</xyz>`
      2. `<xyz>{{ constructor.constructor('alert(1)')() }}</xyz>`
      3. `<p><xyz>{{ constructor.constructor('alert(1)')() }}</p>`
      4. `<p><xyz>{{ constructor.constructor('alert(1)')() }}</xyz></p>`
      5. `<p>&lt;xyz&gt;{{constructor.constructor('alert("Test Case 8")')()}}&lt;xyz&gt;{{constructor.constructor('alert("Test Case 9")')()}}&lt;/xyz&gt;</p>`
      
      This commit enhances the robustness and reliability of handling mustache expressions and ensures proper assignment of the `v-pre` attribute, to ensure that there is no room for the weaponization of the template code later in the rendering process.
      
      * fix: move template expressions after dom-purify + handle text nodes without parent
      
      ---------
      
      Co-authored-by: default avatarNGPixel <github@ngpixel.com>
  3. Apr 29, 2024
  4. Apr 25, 2024
  5. Mar 16, 2024
  6. Feb 28, 2024
  7. Feb 07, 2024
  8. Jan 29, 2024
  9. Jan 23, 2024
  10. Jan 21, 2024
  11. Nov 20, 2023
  12. Oct 27, 2023
  13. Oct 19, 2023
  14. Sep 25, 2023
  15. Sep 20, 2023
  16. Sep 07, 2023
  17. Sep 04, 2023
  18. Sep 01, 2023
  19. Aug 23, 2023
  20. Aug 22, 2023
  21. Aug 18, 2023
  22. Aug 17, 2023
  23. Aug 10, 2023
  24. Jul 28, 2023
  25. Jul 05, 2023
  26. Jun 16, 2023
  27. Jun 04, 2023
Loading