You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

Ethan 1238d614e1 Merge pull request from GHSA-xjcj-p2qv-q3rf ... * Update render.js # Improved handling of mustache expressions and v-pre attribute assignment ## Changes Made: - Ensured that the parent tag of such text nodes is explicitly set to a `<p>` tag with the `v-pre` attribute. - Added debug messages for better understanding of the script execution flow [THIS SHOULD REMOVED WHEN PUSHING TO PRODUCTION]. ## Why it Works: - When a mustache expression is found, the script either wraps it in a new `<p>` tag with the `v-pre` attribute or adds the `v-pre` attribute to the existing parent `<p>` tag. - This approach ensures that the template code is not removed but encapsulated within `<p>` tags with the `v-pre` attribute, as required. ## Test Cases Passed: 1. `<xyz>{{ constructor.constructor('alert(1)')() }}</xyz>` 2. `<xyz>{{ constructor.constructor('alert(1)')() }}</xyz>` 3. `<p><xyz>{{ constructor.constructor('alert(1)')() }}</p>` 4. `<p><xyz>{{ constructor.constructor('alert(1)')() }}</xyz></p>` 5. `<p>&lt;xyz&gt;{{constructor.constructor('alert("Test Case 8")')()}}&lt;xyz&gt;{{constructor.constructor('alert("Test Case 9")')()}}&lt;/xyz&gt;</p>` This commit enhances the robustness and reliability of handling mustache expressions and ensures proper assignment of the `v-pre` attribute, to ensure that there is no room for the weaponization of the template code later in the rendering process. * fix: move template expressions after dom-purify + handle text nodes without parent --------- Co-authored-by: NGPixel <github@ngpixel.com>		2 years ago
..
asciidoc-core	feat: add asciidoc editor module (#5954)	3 years ago
html-asciinema	…
html-blockquotes	…
html-codehighlighter	…
html-core	Merge pull request from GHSA-xjcj-p2qv-q3rf	2 years ago
html-diagram	…
html-image-prefetch	fix: typo in kroki name (#6745)	2 years ago
html-mediaplayers	…
html-mermaid	…
html-security	…
html-tabset	…
html-twemoji	…
markdown-abbr	…
markdown-core	…
markdown-emoji	feat: upgrade markdown-it-emoji to 3.0.0 (#6945)	2 years ago
markdown-expandtabs	…
markdown-footnotes	…
markdown-imsize	…
markdown-katex	feat: katex persistent macro support (#5838)	3 years ago
markdown-kroki	…
markdown-mathjax	…
markdown-multi-table	…
markdown-pivot-table	feat: add markdown-it-pivot-table rendering module (#6574)	2 years ago
markdown-plantuml	…
markdown-supsub	…
markdown-tasklists	…
openapi-core	…