Skip to content

Tags: requarks/wiki

Tags

v2.5.311

Toggle v2.5.311's commit message

Verified

This commit was signed with the committer’s verified signature.
NGPixel Nicolas Giard
fix: add cookie secure flag when site is using https (client-side)

v2.5.310

Toggle v2.5.310's commit message

Verified

This commit was signed with the committer’s verified signature.
NGPixel Nicolas Giard
fix: use promisified pipeline from stream

v2.5.309

Toggle v2.5.309's commit message

Verified

This commit was signed with the committer’s verified signature.
NGPixel Nicolas Giard
chore: update dependencies

v2.5.308

Toggle v2.5.308's commit message

Verified

This commit was signed with the committer’s verified signature.
NGPixel Nicolas Giard
fix: force wrap for code blocks in print view

v2.5.307

Toggle v2.5.307's commit message

Verified

This commit was signed with the committer’s verified signature.
NGPixel Nicolas Giard
fix: use xml-crypto 2.1.6 for passport-saml

v2.5.306

Toggle v2.5.306's commit message

Verified

This commit was signed with the committer’s verified signature.
NGPixel Nicolas Giard
feat: add git always namespace option

v2.5.305

Toggle v2.5.305's commit message

Verified

This commit was signed with the committer’s verified signature.
NGPixel Nicolas Giard
chore: update yarn lock

v2.5.304

Toggle v2.5.304's commit message

Verified

This commit was created on GitHub.com and signed with GitHub’s verified signature.
ci: fix docker manifest typo

v2.5.303

Toggle v2.5.303's commit message

Partially verified

This commit was created on GitHub.com and signed with GitHub’s verified signature.
We cannot verify signatures from co-authors, and some of the co-authors attributed to this commit require their commits to be signed.
Merge pull request from GHSA-xjcj-p2qv-q3rf

* Update render.js

# Improved handling of mustache expressions and v-pre attribute assignment

## Changes Made:
- Ensured that the parent tag of such text nodes is explicitly set to a `<p>` tag with the `v-pre` attribute.
- Added debug messages for better understanding of the script execution flow [THIS SHOULD REMOVED WHEN PUSHING TO PRODUCTION].

## Why it Works:
- When a mustache expression is found, the script either wraps it in a new `<p>` tag with the `v-pre` attribute or adds the `v-pre` attribute to the existing parent `<p>` tag.
- This approach ensures that the template code is not removed but encapsulated within `<p>` tags with the `v-pre` attribute, as required.

## Test Cases Passed:
1. `<xyz>{{ constructor.constructor('alert(1)')() }}</xyz>`
2. `<xyz>{{ constructor.constructor('alert(1)')() }}</xyz>`
3. `<p><xyz>{{ constructor.constructor('alert(1)')() }}</p>`
4. `<p><xyz>{{ constructor.constructor('alert(1)')() }}</xyz></p>`
5. `<p>&lt;xyz&gt;{{constructor.constructor('alert("Test Case 8")')()}}&lt;xyz&gt;{{constructor.constructor('alert("Test Case 9")')()}}&lt;/xyz&gt;</p>`

This commit enhances the robustness and reliability of handling mustache expressions and ensures proper assignment of the `v-pre` attribute, to ensure that there is no room for the weaponization of the template code later in the rendering process.

* fix: move template expressions after dom-purify + handle text nodes without parent

---------

Co-authored-by: NGPixel <[email protected]>

v2.5.302

Toggle v2.5.302's commit message

Partially verified

This commit was created on GitHub.com and signed with GitHub’s verified signature.
We cannot verify signatures from co-authors, and some of the co-authors attributed to this commit require their commits to be signed.
fix: make comment module "Artalk" work with newer versions (#6901)

* feat: update comment module "Artalk"
* fix: update code.yml

---------

Co-authored-by: Nicolas Giard <[email protected]>