32 Commits (main)

Author	SHA1	Message	Date
Ethan	1238d614e1	Merge pull request from GHSA-xjcj-p2qv-q3rf ... * Update render.js # Improved handling of mustache expressions and v-pre attribute assignment ## Changes Made: - Ensured that the parent tag of such text nodes is explicitly set to a `<p>` tag with the `v-pre` attribute. - Added debug messages for better understanding of the script execution flow [THIS SHOULD REMOVED WHEN PUSHING TO PRODUCTION]. ## Why it Works: - When a mustache expression is found, the script either wraps it in a new `<p>` tag with the `v-pre` attribute or adds the `v-pre` attribute to the existing parent `<p>` tag. - This approach ensures that the template code is not removed but encapsulated within `<p>` tags with the `v-pre` attribute, as required. ## Test Cases Passed: 1. `<xyz>{{ constructor.constructor('alert(1)')() }}</xyz>` 2. `<xyz>{{ constructor.constructor('alert(1)')() }}</xyz>` 3. `<p><xyz>{{ constructor.constructor('alert(1)')() }}</p>` 4. `<p><xyz>{{ constructor.constructor('alert(1)')() }}</xyz></p>` 5. `<p>&lt;xyz&gt;{{constructor.constructor('alert("Test Case 8")')()}}&lt;xyz&gt;{{constructor.constructor('alert("Test Case 9")')()}}&lt;/xyz&gt;</p>` This commit enhances the robustness and reliability of handling mustache expressions and ensures proper assignment of the `v-pre` attribute, to ensure that there is no room for the weaponization of the template code later in the rendering process. * fix: move template expressions after dom-purify + handle text nodes without parent --------- Co-authored-by: NGPixel <github@ngpixel.com>	6 months ago
NGPixel	9fbc25adb8	feat: improve table rendering + add markdown-it-decorate module	2 years ago
NGPixel	a50712ea80	fix: handle links to same host but different port as external	3 years ago
broxen	12aef93cd6	fix: remove excess div wrappers (#4528) ... * Removing superfluous div wrapping It seems like standalone text is already wrapped in paragraph elements, so this code seems superfluous. Additionally, it adds div wrappers at every line break as described in #4524 * Fix for newlines and returns This change skips newlines and returns to focus on unbounded text only. * misc: fix indentation * misc: fix indentation (2) Co-authored-by: Nicolas Giard <github@ngpixel.com>	3 years ago
broxen	db73b650c9	fix: issue with Custom Header IDs (#4527) ... Fix the issue described in discussion #3502 regarding header links and TOC failing to properly generate when header ID is custom defined.	3 years ago
LK HO	a20f70ed8d	fix: rendering/html-core - null checks (#3823)	4 years ago
NGPixel	d75c5532d1	fix: handle raw mustache expressions over multiple lines	4 years ago
NGPixel	5ffa189383	fix: add v-pre to pre tags at render time	4 years ago
Regev Brody	77086a6e0a	feat: optional kroki/plantuml svg caching (#2047) ... * feat: Caching kroki svgs #2020	4 years ago
Nicolas Giard	9e08718ee9	Merge pull request from GHSA-9jgg-4xj2-vjjj	4 years ago
NGPixel	98bf0d9ccb	fix: escape mustache template chars in content	5 years ago
daneallen	4aa7828a92	fix: add rel option to external links in content (#1853) ... * #1853: XSS attack fix by adding rel noferrer or rel noopen to _blank target external links * fix: relAttributeExternalLink noopener Co-authored-by: danallendds <daniel.allen@friends.dds.mil> Co-authored-by: Nicolas Giard <github@ngpixel.com>	5 years ago
NGPixel	b529ad21c9	fix: code blocks incorrect escaping + deps update	5 years ago
NGPixel	2d06a1d9df	fix: set open external link in new tab as an option	5 years ago
Lukáš Hrdlička	fc79d92423	feat: open external link in new tab (#1453)	5 years ago
NGPixel	0755c538ed	fix: html rendering order param + decodeEntities	5 years ago
NGPixel	edd11cd73f	feat: make relative links root absolute option	5 years ago
NGPixel	82376c19b9	fix: render system link detection resets on each find	5 years ago
Scott Simontis	bb03aed1c8	fix: exclude tel: links from parsing #1318 (#1344) ... Telephone links will no longer be incorrectly parsed as web links. Signed-off-by: Scott Simontis <yo@scottsimontis.io>	5 years ago
NGPixel	278cd7173d	feat: rendering security module	5 years ago
NGPixel	e35e68d764	fix: exclude assets from internal link detection (#1189)	5 years ago
NGPixel	8ba78dd771	fix: handle link reformatting from home path (#1169)	5 years ago
NGPixel	d78127dc29	fix: handle link reformatting when not using namespacing + 5 letters locales support (#1165, #1166)	5 years ago
NGPixel	37ce116dd2	fix: handle headers for all editors (#1127)	5 years ago
Nick	06250c4f03	fix: ignore mailto links from processing (#1041)	5 years ago
Juan Baez	3ab7bcf8ea	fix: host ref in html-core renderer (#1021) ... Fixing typo on: "server\modules\rendering\html-core\renderer.js" Lines 40 and 41. Invalid reference to "WIKI.config.site.host" -- should be: "WIKI.config.host" This was causing rendering issues when attempting to create some sample pages; such as: https://github.com/jbaez001/markdown-cheatsheet	5 years ago
Nick	33e31a9901	feat: page links table	5 years ago
Nick	efab00fa0c	feat: content link states	5 years ago
Nick	c4629419d3	fix: admin rendering UI + dark mode	5 years ago
Nicolas Giard	1771289188	feat: twemoji + headers fix	6 years ago
Nicolas Giard	578ea577f0	feat: html code highlighter	6 years ago
Nicolas Giard	09d1f580d9	feat: rendering pipeline logic	6 years ago