• Ethan's avatar
    Merge pull request from GHSA-xjcj-p2qv-q3rf · 1238d614
    Ethan authored
    * Update render.js
    
    # Improved handling of mustache expressions and v-pre attribute assignment
    
    ## Changes Made:
    - Ensured that the parent tag of such text nodes is explicitly set to a `<p>` tag with the `v-pre` attribute.
    - Added debug messages for better understanding of the script execution flow [THIS SHOULD REMOVED WHEN PUSHING TO PRODUCTION].
    
    ## Why it Works:
    - When a mustache expression is found, the script either wraps it in a new `<p>` tag with the `v-pre` attribute or adds the `v-pre` attribute to the existing parent `<p>` tag.
    - This approach ensures that the template code is not removed but encapsulated within `<p>` tags with the `v-pre` attribute, as required.
    
    ## Test Cases Passed:
    1. `<xyz>{{ constructor.constructor('alert(1)')() }}</xyz>`
    2. `<xyz>{{ constructor.constructor('alert(1)')() }}</xyz>`
    3. `<p><xyz>{{ constructor.constructor('alert(1)')() }}</p>`
    4. `<p><xyz>{{ constructor.constructor('alert(1)')() }}</xyz></p>`
    5. `<p>&lt;xyz&gt;{{constructor.constructor('alert("Test Case 8")')()}}&lt;xyz&gt;{{constructor.constructor('alert("Test Case 9")')()}}&lt;/xyz&gt;</p>`
    
    This commit enhances the robustness and reliability of handling mustache expressions and ensures proper assignment of the `v-pre` attribute, to ensure that there is no room for the weaponization of the template code later in the rendering process.
    
    * fix: move template expressions after dom-purify + handle text nodes without parent
    
    ---------
    Co-authored-by: 's avatarNGPixel <github@ngpixel.com>
    1238d614
Name
Last commit
Last update
..
asciidoc-core Loading commit data...
html-asciinema Loading commit data...
html-blockquotes Loading commit data...
html-codehighlighter Loading commit data...
html-core Loading commit data...
html-diagram Loading commit data...
html-image-prefetch Loading commit data...
html-mediaplayers Loading commit data...
html-mermaid Loading commit data...
html-security Loading commit data...
html-tabset Loading commit data...
html-twemoji Loading commit data...
markdown-abbr Loading commit data...
markdown-core Loading commit data...
markdown-emoji Loading commit data...
markdown-expandtabs Loading commit data...
markdown-footnotes Loading commit data...
markdown-imsize Loading commit data...
markdown-katex Loading commit data...
markdown-kroki Loading commit data...
markdown-mathjax Loading commit data...
markdown-multi-table Loading commit data...
markdown-pivot-table Loading commit data...
markdown-plantuml Loading commit data...
markdown-supsub Loading commit data...
markdown-tasklists Loading commit data...
openapi-core Loading commit data...