f.weber/homebrewery
0
0
Fork 0
mirror of https://github.com/naturalcrit/homebrewery.git synced 2026-08-06 04:37:37 +00:00
Code Wiki Activity

Merge branch 'master' into labels

Browse Source
This commit is contained in:
Víctor Losada Hernández
2026-08-04 16:04:07 +02:00
committed by GitHub
parent 2febc01ff4 6ecbc6f41d
commit d15daa7ad2
5 changed files with 26 additions and 20 deletions
Download Patch File Download Diff File Expand all files Collapse all files
client/components/codeEditor/codeEditor.jsx
+1 -1
View File
@@ -308,7 +308,7 @@ const CodeEditor = forwardRef(
view.dispatch({ view.dispatch({
effects : themeCompartment.reconfigure(themeExtension), effects : themeCompartment.reconfigure(themeExtension),
}); });
}, [editorTheme]); }, [editorTheme, tab]);
useEffect(()=>{ useEffect(()=>{
//rebuild syntax highlight when changing tab or renderer //rebuild syntax highlight when changing tab or renderer
client/homebrew/brewRenderer/safeHTML.js
+4 -4
View File
@@ -32,13 +32,13 @@ function safeHTML(htmlString) {
return; return;
} }
// Check remaining elements for blacklisted attributes // Check remaining elements for blacklisted attributes
for (const attribute of element.attributes){ [...element.attributes].forEach((attribute)=>{
if(blacklistAttrs.some((test)=>{return test(attribute);})) { if(blacklistAttrs.some((test)=>{return test(attribute);})) {
element.removeAttribute(attribute.localName); element.removeAttribute(attribute.name);
break; return;
};
}; };
}); });
});
return div.innerHTML; return div.innerHTML;
}; };
package-lock.json
Generated
+12 -12
View File
@@ -25,7 +25,7 @@
"@codemirror/language-data": "^6.5.2", "@codemirror/language-data": "^6.5.2",
"@codemirror/search": "^6.6.0", "@codemirror/search": "^6.6.0",
"@codemirror/state": "^6.6.0", "@codemirror/state": "^6.6.0",
"@codemirror/view": "^6.43.1", "@codemirror/view": "^6.43.7",
"@dmsnell/diff-match-patch": "^1.1.0", "@dmsnell/diff-match-patch": "^1.1.0",
"@googleapis/drive": "^20.2.0", "@googleapis/drive": "^20.2.0",
"@lezer/highlight": "^1.2.3", "@lezer/highlight": "^1.2.3",
@@ -49,7 +49,7 @@
"idb-keyval": "^6.2.5", "idb-keyval": "^6.2.5",
"js-yaml": "^4.2.0", "js-yaml": "^4.2.0",
"jwt-simple": "^0.5.6", "jwt-simple": "^0.5.6",
"less": "^4.6.4", "less": "^4.8.1",
"lodash": "^4.18.1", "lodash": "^4.18.1",
"marked": "15.0.12", "marked": "15.0.12",
"marked-alignment-paragraphs": "^1.0.0", "marked-alignment-paragraphs": "^1.0.0",
@@ -63,7 +63,7 @@
"marked-variables": "^1.0.5", "marked-variables": "^1.0.5",
"markedLegacy": "npm:marked@^0.3.19", "markedLegacy": "npm:marked@^0.3.19",
"moment": "^2.30.1", "moment": "^2.30.1",
"mongoose": "^9.7.0", "mongoose": "^9.9.0",
"nanoid": "5.1.11", "nanoid": "5.1.11",
"nconf": "^0.13.0", "nconf": "^0.13.0",
"node": "^25.9.0", "node": "^25.9.0",
@@ -2546,9 +2546,9 @@
"license": "MIT" "license": "MIT"
}, },
"node_modules/@codemirror/view": { "node_modules/@codemirror/view": {
"version": "6.43.6", "version": "6.43.7",
"resolved": "https://registry.npmjs.org/@codemirror/view/-/view-6.43.6.tgz", "resolved": "https://registry.npmjs.org/@codemirror/view/-/view-6.43.7.tgz",
"integrity": "sha512-EVunGSYN1wz1p75WY1s3Xg7t3i8Yol0kGZGizNdX9BUFgMFILYVe8/u6EVpo7Ff5PwbZuILb4QAq7IZoKzIEQA==", "integrity": "sha512-FZsExxkoxnAN+d9TgqXLg5g4A1oQwzX9WlkOT5i2PKkcW7xx3Bmu0vs90g6fo9Mpdsb/l96dnAraQ8932aO4/g==",
"license": "MIT", "license": "MIT",
"dependencies": { "dependencies": {
"@codemirror/state": "^6.7.0", "@codemirror/state": "^6.7.0",
@@ -9748,9 +9748,9 @@
} }
}, },
"node_modules/less": { "node_modules/less": {
"version": "4.8.0", "version": "4.8.1",
"resolved": "https://registry.npmjs.org/less/-/less-4.8.0.tgz", "resolved": "https://registry.npmjs.org/less/-/less-4.8.1.tgz",
"integrity": "sha512-7Y7DJBMbsW29UGjOG6NGvxQEx71AaDcrryBwYCMaFwn0kj8FkSueKN9r9WexVOetKEhXh38kL++WJncfkEpS+g==", "integrity": "sha512-jQ3lRIo1aUtiWVYXZ7mk4+V4BjCGswF3IxTLJ+4RUta8ZiHh8lhkig2G8dya2eCcyR1dYUvzuV46EkJN8PSwww==",
"license": "Apache-2.0", "license": "Apache-2.0",
"dependencies": { "dependencies": {
"copy-anything": "^3.0.5", "copy-anything": "^3.0.5",
@@ -10540,9 +10540,9 @@
} }
}, },
"node_modules/mongoose": { "node_modules/mongoose": {
"version": "9.8.0", "version": "9.9.0",
"resolved": "https://registry.npmjs.org/mongoose/-/mongoose-9.8.0.tgz", "resolved": "https://registry.npmjs.org/mongoose/-/mongoose-9.9.0.tgz",
"integrity": "sha512-PDGx3XACxrBQyWf4YT+5s1Xsx19x84UWGlRVIza4i9RG6qKjGcoG7odotT6uquR6YoaDMTZ6ZZc/jMXLrNPyyA==", "integrity": "sha512-xtBH8CU5oRK16F14rC8/KlRHeuPGP+w/URjDdwHV0oyN7otVuqglLje1FePX9+SaSBGj0/QiM65Tg86R7iNbPg==",
"license": "MIT", "license": "MIT",
"dependencies": { "dependencies": {
"@standard-schema/spec": "^1.1.0", "@standard-schema/spec": "^1.1.0",
package.json
+3 -3
View File
@@ -101,7 +101,7 @@
"@codemirror/language-data": "^6.5.2", "@codemirror/language-data": "^6.5.2",
"@codemirror/search": "^6.6.0", "@codemirror/search": "^6.6.0",
"@codemirror/state": "^6.6.0", "@codemirror/state": "^6.6.0",
"@codemirror/view": "^6.43.1", "@codemirror/view": "^6.43.7",
"@dmsnell/diff-match-patch": "^1.1.0", "@dmsnell/diff-match-patch": "^1.1.0",
"@googleapis/drive": "^20.2.0", "@googleapis/drive": "^20.2.0",
"@lezer/highlight": "^1.2.3", "@lezer/highlight": "^1.2.3",
@@ -125,7 +125,7 @@
"idb-keyval": "^6.2.5", "idb-keyval": "^6.2.5",
"js-yaml": "^4.2.0", "js-yaml": "^4.2.0",
"jwt-simple": "^0.5.6", "jwt-simple": "^0.5.6",
"less": "^4.6.4", "less": "^4.8.1",
"lodash": "^4.18.1", "lodash": "^4.18.1",
"marked": "15.0.12", "marked": "15.0.12",
"marked-alignment-paragraphs": "^1.0.0", "marked-alignment-paragraphs": "^1.0.0",
@@ -139,7 +139,7 @@
"marked-variables": "^1.0.5", "marked-variables": "^1.0.5",
"markedLegacy": "npm:marked@^0.3.19", "markedLegacy": "npm:marked@^0.3.19",
"moment": "^2.30.1", "moment": "^2.30.1",
"mongoose": "^9.7.0", "mongoose": "^9.9.0",
"nanoid": "5.1.11", "nanoid": "5.1.11",
"nconf": "^0.13.0", "nconf": "^0.13.0",
"node": "^25.9.0", "node": "^25.9.0",
tests/html/safeHTML.test.js
+6
View File
@@ -43,6 +43,12 @@ test('Javascript via inline event handler - onMouseOver', function() {
expect(rendered).toBe('<div>Hover over me</div>'); expect(rendered).toBe('<div>Hover over me</div>');
}); });
test('Javascript via multiple inline event handlers - onClick + onMouseOver', function() {
const source = `<div onclick="alert('This is a JavaScript injection via inline event handler')" onmouseover="alert('This is a JavaScript injection via inline event handler')">Hover over or Click me</div>`;
const rendered = safeHTML(source);
expect(rendered).toBe('<div>Hover over or Click me</div>');
});
test('Javascript via data attribute', function() { test('Javascript via data attribute', function() {
const source = `<div data-code="javascript:alert('This is a JavaScript injection via data attribute')">Test</div>`; const source = `<div data-code="javascript:alert('This is a JavaScript injection via data attribute')">Test</div>`;
const rendered = safeHTML(source); const rendered = safeHTML(source);