| author |  Meghan Denny <hello@nektro.net> 2021-08-07 00:45:36 -07:00 |
| committer | Meghan Denny <hello@nektro.net> 2021-08-07 00:45:36 -07:00 |
| log | 728e82a8626115567eaf898c66f767763c0e6cce |
| tree | 1a0b2411dece4c256ce00dcc6ad029d238ebb4b3 |
| parent | a135ca3268d90709492056b008b20238da4dccc0 |
add html entity filtering to prevent tag injection
4 files changed, 25 insertions(+), 1 deletions(-)
src/lib.zig+21-1
| ... | ... | @@ -24,6 +24,7 @@ |
| 24 | 24 | |
| 25 | 25 | const std = @import("std"); |
| 26 | 26 | const range = @import("range").range; |
| 27 | const htmlentities = @import("htmlentities"); | |
| 27 | 28 | |
| 28 | 29 | const tokenize = @import("./tokenize.zig"); |
| 29 | 30 | const astgen = @import("./astgen.zig"); |
| ... | ... | @@ -75,7 +76,14 @@ fn do(writer: anytype, comptime value: astgen.Value, data: anytype, ctx: anytype |
| 75 | 76 | const TO = @TypeOf(x); |
| 76 | 77 | |
| 77 | 78 | if (comptime std.meta.trait.isZigString(TO)) { |
| 78 | try writer.print("{s}", .{x}); | |
| 79 | const s: []const u8 = x; | |
| 80 | for (s) |c| { | |
| 81 | if (entityLookupBefore(&[_]u8{c})) |ent| { | |
| 82 | try writer.writeAll(ent.entity); | |
| 83 | } else { | |
| 84 | try writer.writeAll(&[_]u8{c}); | |
| 85 | } | |
| 86 | } | |
| 79 | 87 | return; |
| 80 | 88 | } |
| 81 | 89 | @compileError("pek: compile: unsupported type: " ++ @typeName(TO)); |
| ... | ... | @@ -101,3 +109,15 @@ fn do(writer: anytype, comptime value: astgen.Value, data: anytype, ctx: anytype |
| 101 | 109 | fn search(comptime T: anytype, comptime args: []const []const u8) @TypeOf(if (args.len == 1) @field(T, args[0]) else search(@field(T, args[0]), args[1..])) { |
| 102 | 110 | return if (args.len == 1) @field(T, args[0]) else search(@field(T, args[0]), args[1..]); |
| 103 | 111 | } |
| 112 | ||
| 113 | fn entityLookupBefore(in: []const u8) ?htmlentities.Entity { | |
| 114 | for (htmlentities.ENTITIES) |e| { | |
| 115 | if (!std.mem.endsWith(u8, e.entity, ";")) { | |
| 116 | continue; | |
| 117 | } | |
| 118 | if (std.mem.eql(u8, e.characters, in)) { | |
| 119 | return e; | |
| 120 | } | |
| 121 | } | |
| 122 | return null; | |
| 123 | } |
src/main.zig+2
| ... | ... | @@ -21,6 +21,7 @@ const example_document = |
| 21 | 21 | \\ li({this.name}", "{this.state.code}) |
| 22 | 22 | \\ /each/ |
| 23 | 23 | \\ ) |
| 24 | \\ p("Spooky text: "{spooky}) | |
| 24 | 25 | \\ ) |
| 25 | 26 | \\) |
| 26 | 27 | ; |
| ... | ... | @@ -39,5 +40,6 @@ pub fn main() !void { |
| 39 | 40 | .{ .name = "Houston", .state = .{ .code = "TX" } }, |
| 40 | 41 | .{ .name = "Phoenix", .state = .{ .code = "AZ" } }, |
| 41 | 42 | }, |
| 43 | .spooky = "<strong>I better not be in bold.</strong>", | |
| 42 | 44 | }); |
| 43 | 45 | } |
zig.mod+1
| ... | ... | @@ -5,3 +5,4 @@ license: AGPL-3.0 |
| 5 | 5 | description: An HTML preprocessor with a builtin template engine. |
| 6 | 6 | dependencies: |
| 7 | 7 | - src: git https://github.com/nektro/zig-range |
| 8 | - src: git https://github.com/kivikakk/htmlentities.zig |
zigmod.lock+1
| ... | ... | @@ -1,2 +1,3 @@ |
| 1 | 1 | 2 |
| 2 | 2 | git https://github.com/nektro/zig-range commit-890ca308fe09b3d5c866d5cfb3b3d7a95dbf939f |
| 3 | git https://github.com/kivikakk/htmlentities.zig commit-c3cbe4cb3a9a9bd60e7c9fedcf9b97e087b98d6c |