You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

Ethan 1238d614e1 Merge pull request from GHSA-xjcj-p2qv-q3rf ... * Update render.js # Improved handling of mustache expressions and v-pre attribute assignment ## Changes Made: - Ensured that the parent tag of such text nodes is explicitly set to a `<p>` tag with the `v-pre` attribute. - Added debug messages for better understanding of the script execution flow [THIS SHOULD REMOVED WHEN PUSHING TO PRODUCTION]. ## Why it Works: - When a mustache expression is found, the script either wraps it in a new `<p>` tag with the `v-pre` attribute or adds the `v-pre` attribute to the existing parent `<p>` tag. - This approach ensures that the template code is not removed but encapsulated within `<p>` tags with the `v-pre` attribute, as required. ## Test Cases Passed: 1. `<xyz>{{ constructor.constructor('alert(1)')() }}</xyz>` 2. `<xyz>{{ constructor.constructor('alert(1)')() }}</xyz>` 3. `<p><xyz>{{ constructor.constructor('alert(1)')() }}</p>` 4. `<p><xyz>{{ constructor.constructor('alert(1)')() }}</xyz></p>` 5. `<p>&lt;xyz&gt;{{constructor.constructor('alert("Test Case 8")')()}}&lt;xyz&gt;{{constructor.constructor('alert("Test Case 9")')()}}&lt;/xyz&gt;</p>` This commit enhances the robustness and reliability of handling mustache expressions and ensures proper assignment of the `v-pre` attribute, to ensure that there is no room for the weaponization of the template code later in the rendering process. * fix: move template expressions after dom-purify + handle text nodes without parent --------- Co-authored-by: NGPixel <github@ngpixel.com>		7 months ago
..
asciidoc-core	feat: add asciidoc editor module (#5954)	2 years ago
html-asciinema	fix: admin rendering UI + dark mode	5 years ago
html-blockquotes	fix: admin rendering UI + dark mode	5 years ago
html-codehighlighter	feat: rendering security module	5 years ago
html-core	Merge pull request from GHSA-xjcj-p2qv-q3rf	7 months ago
html-diagram	feat: diagram rendering + post-processor (wip)	5 years ago
html-image-prefetch	fix: typo in kroki name (#6745)	1 year ago
html-mediaplayers	fix: missing footnote module in markdown editor preview	5 years ago
html-mermaid	fix: enable mermaid by default	5 years ago
html-security	fix: security html module removes allow attribute from iframes (#2354)	4 years ago
html-tabset	fix: use semver for latest version check	5 years ago
html-twemoji	fix: html rendering order param + decodeEntities	5 years ago
markdown-abbr	fix: admin rendering UI + dark mode	5 years ago
markdown-core	feat: improve table rendering + add markdown-it-decorate module	2 years ago
markdown-emoji	feat: upgrade markdown-it-emoji to 3.0.0 (#6945)	11 months ago
markdown-expandtabs	fix: admin rendering UI + dark mode	5 years ago
markdown-footnotes	fix: admin rendering UI + dark mode	5 years ago
markdown-imsize	fix: admin rendering UI + dark mode	5 years ago
markdown-katex	feat: katex persistent macro support (#5838)	2 years ago
markdown-kroki	fix: revert refactor in markdown-kroki and plantuml modules (#2619)	4 years ago
markdown-mathjax	feat: mathjax markdown module	5 years ago
markdown-multi-table	feat: support MultiMarkdown tables (#2126)	5 years ago
markdown-pivot-table	feat: add markdown-it-pivot-table rendering module (#6574)	1 year ago
markdown-plantuml	fix: revert refactor in markdown-kroki and plantuml modules (#2619)	4 years ago
markdown-supsub	fix: superscript typo in module definition.yml (#2577)	4 years ago
markdown-tasklists	fix: md task list - use same config as client	3 years ago
openapi-core	feat: delete a user	5 years ago