1. 20 Jan, 2025 1 commit
  2. 14 Jun, 2024 1 commit
  3. 24 May, 2024 1 commit
  4. 13 May, 2024 1 commit
    • Ethan's avatar
      Merge pull request from GHSA-xjcj-p2qv-q3rf · 1238d614
      Ethan authored
      * Update render.js
      
      # Improved handling of mustache expressions and v-pre attribute assignment
      
      ## Changes Made:
      - Ensured that the parent tag of such text nodes is explicitly set to a `<p>` tag with the `v-pre` attribute.
      - Added debug messages for better understanding of the script execution flow [THIS SHOULD REMOVED WHEN PUSHING TO PRODUCTION].
      
      ## Why it Works:
      - When a mustache expression is found, the script either wraps it in a new `<p>` tag with the `v-pre` attribute or adds the `v-pre` attribute to the existing parent `<p>` tag.
      - This approach ensures that the template code is not removed but encapsulated within `<p>` tags with the `v-pre` attribute, as required.
      
      ## Test Cases Passed:
      1. `<xyz>{{ constructor.constructor('alert(1)')() }}</xyz>`
      2. `<xyz>{{ constructor.constructor('alert(1)')() }}</xyz>`
      3. `<p><xyz>{{ constructor.constructor('alert(1)')() }}</p>`
      4. `<p><xyz>{{ constructor.constructor('alert(1)')() }}</xyz></p>`
      5. `<p>&lt;xyz&gt;{{constructor.constructor('alert("Test Case 8")')()}}&lt;xyz&gt;{{constructor.constructor('alert("Test Case 9")')()}}&lt;/xyz&gt;</p>`
      
      This commit enhances the robustness and reliability of handling mustache expressions and ensures proper assignment of the `v-pre` attribute, to ensure that there is no room for the weaponization of the template code later in the rendering process.
      
      * fix: move template expressions after dom-purify + handle text nodes without parent
      
      ---------
      Co-authored-by: 's avatarNGPixel <github@ngpixel.com>
      1238d614
  5. 29 Apr, 2024 3 commits
  6. 25 Apr, 2024 4 commits
  7. 16 Mar, 2024 1 commit
  8. 28 Feb, 2024 1 commit
  9. 07 Feb, 2024 1 commit
  10. 29 Jan, 2024 1 commit
  11. 23 Jan, 2024 1 commit
  12. 21 Jan, 2024 1 commit
  13. 20 Nov, 2023 1 commit
  14. 27 Oct, 2023 1 commit
  15. 19 Oct, 2023 1 commit
  16. 25 Sep, 2023 1 commit
  17. 20 Sep, 2023 2 commits
  18. 07 Sep, 2023 1 commit
  19. 04 Sep, 2023 1 commit
  20. 01 Sep, 2023 3 commits
  21. 23 Aug, 2023 1 commit
  22. 22 Aug, 2023 1 commit
  23. 18 Aug, 2023 1 commit
  24. 17 Aug, 2023 1 commit
  25. 10 Aug, 2023 4 commits
  26. 28 Jul, 2023 1 commit
  27. 05 Jul, 2023 1 commit
  28. 16 Jun, 2023 1 commit
  29. 04 Jun, 2023 1 commit