mirror of
https://github.com/git-pkgs/proxy.git
synced 2026-11-09 15:49:16 -05:00
f5e7599749The source browser built its file tree with onclick handlers such as
loadFile('${escapeHTML(file.path)}'). The browser decodes HTML entities in
an attribute before running the handler, so the ' that escapeHTML
produces turns back into a quote and ends the string. A cached package
with a crafted file name ran script on the proxy origin for anyone who
browsed it.
- Carry the path in data-path and dispatch clicks from one delegated
listener on the file tree
- Render the binary download button as a link instead of an onclick
that assigns window.location
- Fail the template tests when an inline handler interpolates data
32 lines
940 B
Go
32 lines
940 B
Go
package server
|
|
|
|
import (
|
|
"io/fs"
|
|
"regexp"
|
|
"testing"
|
|
)
|
|
|
|
// inlineHandlerWithData matches an inline event handler attribute whose value
|
|
// interpolates a JavaScript template expression. The browser decodes HTML
|
|
// entities in the attribute before running the handler, so escapeHTML cannot
|
|
// keep a quote in the interpolated value from ending the handler's string.
|
|
var inlineHandlerWithData = regexp.MustCompile(`\son[a-z]+\s*=\s*"[^"]*\$\{`)
|
|
|
|
func TestTemplatesInterpolateNoDataIntoInlineHandlers(t *testing.T) {
|
|
err := fs.WalkDir(templatesFS, "templates", func(path string, d fs.DirEntry, err error) error {
|
|
if err != nil || d.IsDir() {
|
|
return err
|
|
}
|
|
source, err := fs.ReadFile(templatesFS, path)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
for _, match := range inlineHandlerWithData.FindAll(source, -1) {
|
|
t.Errorf("%s: inline handler interpolates data: %s", path, match)
|
|
}
|
|
return nil
|
|
})
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
}
|