1. 13 May, 2024 1 commit
    • Ethan's avatar
      Merge pull request from GHSA-xjcj-p2qv-q3rf · 1238d614
      Ethan authored
      * Update render.js
      
      # Improved handling of mustache expressions and v-pre attribute assignment
      
      ## Changes Made:
      - Ensured that the parent tag of such text nodes is explicitly set to a `<p>` tag with the `v-pre` attribute.
      - Added debug messages for better understanding of the script execution flow [THIS SHOULD REMOVED WHEN PUSHING TO PRODUCTION].
      
      ## Why it Works:
      - When a mustache expression is found, the script either wraps it in a new `<p>` tag with the `v-pre` attribute or adds the `v-pre` attribute to the existing parent `<p>` tag.
      - This approach ensures that the template code is not removed but encapsulated within `<p>` tags with the `v-pre` attribute, as required.
      
      ## Test Cases Passed:
      1. `<xyz>{{ constructor.constructor('alert(1)')() }}</xyz>`
      2. `<xyz>{{ constructor.constructor('alert(1)')() }}</xyz>`
      3. `<p><xyz>{{ constructor.constructor('alert(1)')() }}</p>`
      4. `<p><xyz>{{ constructor.constructor('alert(1)')() }}</xyz></p>`
      5. `<p>&lt;xyz&gt;{{constructor.constructor('alert("Test Case 8")')()}}&lt;xyz&gt;{{constructor.constructor('alert("Test Case 9")')()}}&lt;/xyz&gt;</p>`
      
      This commit enhances the robustness and reliability of handling mustache expressions and ensures proper assignment of the `v-pre` attribute, to ensure that there is no room for the weaponization of the template code later in the rendering process.
      
      * fix: move template expressions after dom-purify + handle text nodes without parent
      
      ---------
      Co-authored-by: 's avatarNGPixel <github@ngpixel.com>
      1238d614
  2. 23 Jan, 2024 1 commit
  3. 25 Sep, 2023 1 commit
  4. 28 Jul, 2023 1 commit
  5. 24 Dec, 2022 1 commit
  6. 13 Nov, 2022 1 commit
  7. 09 Nov, 2022 1 commit
  8. 03 Apr, 2022 1 commit
  9. 12 Feb, 2022 1 commit
  10. 09 Oct, 2021 1 commit
    • broxen's avatar
      fix: remove excess div wrappers (#4528) · 12aef93c
      broxen authored
      * Removing superfluous div wrapping
      
      It seems like standalone text is already wrapped in paragraph elements, so this code seems superfluous. Additionally, it adds div wrappers at every line break as described in #4524
      
      * Fix for newlines and returns
      
      This change skips newlines and returns to focus on unbounded text only.
      
      * misc: fix indentation
      
      * misc: fix indentation (2)
      Co-authored-by: 's avatarNicolas Giard <github@ngpixel.com>
      12aef93c
  11. 02 Oct, 2021 1 commit
  12. 12 Apr, 2021 1 commit
  13. 26 Mar, 2021 1 commit
  14. 12 Mar, 2021 1 commit
  15. 01 Nov, 2020 1 commit
  16. 26 Oct, 2020 1 commit
  17. 14 Oct, 2020 1 commit
  18. 13 Sep, 2020 1 commit
  19. 12 Sep, 2020 1 commit
  20. 12 Jul, 2020 1 commit
  21. 03 Jul, 2020 1 commit
  22. 19 Jun, 2020 1 commit
  23. 18 Jun, 2020 2 commits
  24. 14 Jun, 2020 1 commit
  25. 07 Jun, 2020 1 commit
  26. 21 May, 2020 1 commit
  27. 17 May, 2020 1 commit
  28. 11 May, 2020 1 commit
  29. 09 May, 2020 1 commit
  30. 08 May, 2020 2 commits
  31. 07 May, 2020 1 commit
  32. 02 May, 2020 1 commit
  33. 30 Apr, 2020 1 commit
  34. 27 Apr, 2020 2 commits
  35. 18 Apr, 2020 1 commit
  36. 17 Apr, 2020 2 commits