• Ethan's avatar
    Merge pull request from GHSA-xjcj-p2qv-q3rf · 1238d614
    Ethan authored
    * Update render.js
    
    # Improved handling of mustache expressions and v-pre attribute assignment
    
    ## Changes Made:
    - Ensured that the parent tag of such text nodes is explicitly set to a `<p>` tag with the `v-pre` attribute.
    - Added debug messages for better understanding of the script execution flow [THIS SHOULD REMOVED WHEN PUSHING TO PRODUCTION].
    
    ## Why it Works:
    - When a mustache expression is found, the script either wraps it in a new `<p>` tag with the `v-pre` attribute or adds the `v-pre` attribute to the existing parent `<p>` tag.
    - This approach ensures that the template code is not removed but encapsulated within `<p>` tags with the `v-pre` attribute, as required.
    
    ## Test Cases Passed:
    1. `<xyz>{{ constructor.constructor('alert(1)')() }}</xyz>`
    2. `<xyz>{{ constructor.constructor('alert(1)')() }}</xyz>`
    3. `<p><xyz>{{ constructor.constructor('alert(1)')() }}</p>`
    4. `<p><xyz>{{ constructor.constructor('alert(1)')() }}</xyz></p>`
    5. `<p>&lt;xyz&gt;{{constructor.constructor('alert("Test Case 8")')()}}&lt;xyz&gt;{{constructor.constructor('alert("Test Case 9")')()}}&lt;/xyz&gt;</p>`
    
    This commit enhances the robustness and reliability of handling mustache expressions and ensures proper assignment of the `v-pre` attribute, to ensure that there is no room for the weaponization of the template code later in the rendering process.
    
    * fix: move template expressions after dom-purify + handle text nodes without parent
    
    ---------
    Co-authored-by: 's avatarNGPixel <github@ngpixel.com>
    1238d614
Name
Last commit
Last update
.devcontainer Loading commit data...
.github Loading commit data...
.vscode Loading commit data...
client Loading commit data...
dev Loading commit data...
patches Loading commit data...
server Loading commit data...
.babelrc Loading commit data...
.editorconfig Loading commit data...
.eslintignore Loading commit data...
.eslintrc.yml Loading commit data...
.gitattributes Loading commit data...
.gitignore Loading commit data...
.npmrc Loading commit data...
.nvmrc Loading commit data...
LICENSE Loading commit data...
README.md Loading commit data...
SECURITY.md Loading commit data...
config.sample.yml Loading commit data...
cypress.json Loading commit data...
package.json Loading commit data...
yarn.lock Loading commit data...