Skip to content

Tags: requarks/wiki

Tags

v2.5.303

Toggle v2.5.303's commit message

Partially verified

This commit was created on GitHub.com and signed with GitHub’s verified signature.
We cannot verify signatures from co-authors, and some of the co-authors attributed to this commit require their commits to be signed.
Merge pull request from GHSA-xjcj-p2qv-q3rf

* Update render.js

# Improved handling of mustache expressions and v-pre attribute assignment

## Changes Made:
- Ensured that the parent tag of such text nodes is explicitly set to a `<p>` tag with the `v-pre` attribute.
- Added debug messages for better understanding of the script execution flow [THIS SHOULD REMOVED WHEN PUSHING TO PRODUCTION].

## Why it Works:
- When a mustache expression is found, the script either wraps it in a new `<p>` tag with the `v-pre` attribute or adds the `v-pre` attribute to the existing parent `<p>` tag.
- This approach ensures that the template code is not removed but encapsulated within `<p>` tags with the `v-pre` attribute, as required.

## Test Cases Passed:
1. `<xyz>{{ constructor.constructor('alert(1)')() }}</xyz>`
2. `<xyz>{{ constructor.constructor('alert(1)')() }}</xyz>`
3. `<p><xyz>{{ constructor.constructor('alert(1)')() }}</p>`
4. `<p><xyz>{{ constructor.constructor('alert(1)')() }}</xyz></p>`
5. `<p>&lt;xyz&gt;{{constructor.constructor('alert("Test Case 8")')()}}&lt;xyz&gt;{{constructor.constructor('alert("Test Case 9")')()}}&lt;/xyz&gt;</p>`

This commit enhances the robustness and reliability of handling mustache expressions and ensures proper assignment of the `v-pre` attribute, to ensure that there is no room for the weaponization of the template code later in the rendering process.

* fix: move template expressions after dom-purify + handle text nodes without parent

---------

Co-authored-by: NGPixel <[email protected]>

v2.5.302

Toggle v2.5.302's commit message

Partially verified

This commit was created on GitHub.com and signed with GitHub’s verified signature.
We cannot verify signatures from co-authors, and some of the co-authors attributed to this commit require their commits to be signed.
fix: make comment module "Artalk" work with newer versions (#6901)

* feat: update comment module "Artalk"
* fix: update code.yml

---------

Co-authored-by: Nicolas Giard <[email protected]>

v2.5.301

Toggle v2.5.301's commit message

Verified

This commit was created on GitHub.com and signed with GitHub’s verified signature.
fix: set securityTrustProxy to false by default

v2.5.300

Toggle v2.5.300's commit message

Verified

This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
ci: fix missing patches folder in docker images

v2.5.299

Toggle v2.5.299's commit message

Partially verified

This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
We cannot verify signatures from co-authors, and some of the co-authors attributed to this commit require their commits to be signed.
feat: add v2 of analytics module umami (#6442)

* feat: create analytics module umami2

---------

Co-authored-by: Nicolas Giard <[email protected]>

v2.5.298

Toggle v2.5.298's commit message

Partially verified

This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
We cannot verify signatures from co-authors, and some of the co-authors attributed to this commit require their commits to be signed.
fix: make list paragraphs use 100% width (#6273)

* Adds width 100% for ol paragraph

---------

Co-authored-by: Nicolas Giard <[email protected]>

v2.5.297

Toggle v2.5.297's commit message

Verified

This commit was signed with the committer’s verified signature. The key has expired.
NGPixel Nicolas Giard
fix: handle empty ToC position value

v2.5.296

Toggle v2.5.296's commit message

Verified

This commit was signed with the committer’s verified signature. The key has expired.
NGPixel Nicolas Giard
fix: change simple-git import

v2.5.295

Toggle v2.5.295's commit message

Partially verified

This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
We cannot verify signatures from co-authors, and some of the co-authors attributed to this commit require their commits to be signed.
feat: add asciidoc editor module (#5954)

* feat: add asciidoc editor module

* fix storage file extension for asciidoc pages

* fix: asciidoc editor + rendering improvements

* fix: description list css improvements

Co-authored-by: NGPixel <[email protected]>

v2.5.294

Toggle v2.5.294's commit message

Verified

This commit was signed with the committer’s verified signature. The key has expired.
NGPixel Nicolas Giard
fix: edit buttons header alignment when toc sidebar is on the right