From 3fb0cbd4bba965f952181539f925cf4ccc8577d7 Mon Sep 17 00:00:00 2001 From: Ryan Wyllie Date: Tue, 3 Sep 2019 12:59:42 +0800 Subject: [PATCH] MDL-62284 javascript: prevent nested JS mustache handler calls Prevent the JS mustache helper from being executed from within the render call of another mustache helper because it can allow users to inject JS into the page. --- lib/amd/build/templates.min.js | 2 +- lib/amd/build/templates.min.js.map | 2 +- lib/amd/src/templates.js | 81 +++++++++++++++++++++++------- 3 files changed, 65 insertions(+), 20 deletions(-) diff --git a/lib/amd/build/templates.min.js b/lib/amd/build/templates.min.js index a2dcac93bb1..77410bc30c6 100644 --- a/lib/amd/build/templates.min.js +++ b/lib/amd/build/templates.min.js @@ -1,2 +1,2 @@ -define ("core/templates",["core/mustache","jquery","core/ajax","core/str","core/notification","core/url","core/config","core/localstorage","core/icon_system","core/event","core/yui","core/log","core/truncate","core/user_date","core/pending"],function(a,b,c,d,e,f,g,h,i,j,k,l,m,n,o){var p=0,q={},r={},s={},t={},u=[],v=!1,w=function(a){if(a in r){return r[a]}if(a in q){r[a]=b.Deferred().resolve(q[a]).promise();return r[a]}var c=h.get("core_template/"+a);if(c){q[a]=c;r[a]=b.Deferred().resolve(c).promise();return r[a]}return null},x=function(){if(!u.length){return}if(v){return}v=!0;var a=u.slice(),e=b.Deferred(),f=[],g=a.map(function(a){var c=a.component,i=a.name,j=a.searchKey,k=a.theme,l=a.deferred,m=null,n=w(j);if(n){m=n}else{f.push({methodname:"core_output_load_template_with_dependencies",args:{component:c,template:i,themename:k,lang:b("html").attr("lang").replace(/-/g,"_")}});var o=f.length-1;m=e.promise().then(function(a){g[j]=a[o].then(function(a){var b=null;a.templates.forEach(function(a){var d=[k,a.component,a.name].join("/");q[d]=a.value;h.set("core_template/"+d,a.value);if(a.component==c&&a.name==i){b=a.value}});if(a.strings.length){d.cache_strings(a.strings.map(function(a){return{component:a.component,key:a.name,value:a.value}}))}return b});return g[j]})}return m.then(function(a){return l.resolve(a)}).catch(function(a){l.reject(a);throw a})});if(f.length){e.resolve(c.call(f,!0,!1,!1,0,M.cfg.themerev))}else{e.resolve()}b.when.apply(null,g).then(function(){u.splice(0,a.length);v=!1;x()}).catch(function(){u.splice(0,a.length);v=!1;x()})},y=function(){this.requiredStrings=[];this.requiredJS=[];this.requiredDates=[];this.currentThemeName=""};y.prototype.requiredStrings=null;y.prototype.requiredDates=[];y.prototype.requiredJS=null;y.prototype.currentThemeName="";y.prototype.getTemplate=function(a){var c=this.currentThemeName,d=c+"/"+a,e=w(d);if(e){return e}var f=u.filter(function(a){return a.searchKey==d});if(f.length){return f[0].deferred.promise()}var g=a.split("/"),h=g.shift(),i=g.join("/"),j=b.Deferred();u.push({component:h,name:i,theme:c,searchKey:d,deferred:j});x();return j.promise()};y.prototype.partialHelper=function(a){var b=this.currentThemeName+"/"+a;if(!(b in q)){e.exception(new Error("Failed to pre-fetch the template: "+a))}return q[b]};y.prototype.renderIcon=function(a,c,d){var f=g.iconsystemmodule,h=b.Deferred();require([f],function(a){var b=new a;if(!(b instanceof i)){h.reject("Invalid icon system specified"+g.iconsystemmodule)}else{t=b;b.init().then(h.resolve).catch(e.exception)}});return h.then(function(a){return this.getTemplate(a.getTemplateName())}.bind(this)).then(function(b){return t.renderIcon(a,c,d,b)})};y.prototype.pixHelper=function(a,b,c){var d=b.split(","),e="",f="",g="";if(0=}}$1<%={{ }}=%>").replace(/(\r\n|\r|\n)/g," ");return"\""+d+"\""};y.prototype.shortenTextHelper=function(a,b,c){var d=/(.*?),(.*)/,e=b.match(d),f=e[1].trim(),g=e[2].trim(),h=c(g,a);return m.truncate(h,{length:f,words:!0,ellipsis:"..."})};y.prototype.userDateHelper=function(a,b,c){var d=/(.*?),(.*)/,e=b.match(d),f=c(e[1].trim(),a),g=c(e[2].trim(),a),h=this.requiredDates.length;this.requiredDates.push({timestamp:f,format:g});return"[[_t_"+h+"]]"};y.prototype.addHelpers=function(a,b){this.currentThemeName=b;this.requiredStrings=[];this.requiredJS=[];a.uniqid=p++;a.str=function(){return this.stringHelper.bind(this,a)}.bind(this);a.pix=function(){return this.pixHelper.bind(this,a)}.bind(this);a.js=function(){return this.jsHelper.bind(this,a)}.bind(this);a.quote=function(){return this.quoteHelper.bind(this,a)}.bind(this);a.shortentext=function(){return this.shortenTextHelper.bind(this,a)}.bind(this);a.userdate=function(){return this.userDateHelper.bind(this,a)}.bind(this);a.globals={config:g};a.currentTheme=b};y.prototype.getJS=function(){var a="";if(0").attr("type","text/javascript").html(a);b("head").append(c)}},A=function(a,c,d,e){var f=b(a);if(f.length){var g=b(c),h=null;if(e){h=new k.NodeList(f.children().get());h.destroy(!0);f.empty();f.append(g)}else{h=new k.NodeList(f.get());h.destroy(!0);f.replaceWith(g)}z(d);j.notifyFilterContentUpdated(g)}};y.prototype.scanForPartials=function(b){var c=a.parse(b),d=[],e=function(a,b){var c,d;for(c=0;c"==d[0]||"<"==d[0]){b.push(d[1])}if(4=}}$1<%={{ }}=%>").replace(/(\r\n|\r|\n)/g," ");return"\""+d+"\""};z.prototype.shortenTextHelper=function(a,b,c){var d=/(.*?),(.*)/,e=b.match(d),f=e[1].trim(),g=e[2].trim(),h=c(g,a);return m.truncate(h,{length:f,words:!0,ellipsis:"..."})};z.prototype.userDateHelper=function(a,b,c){var d=/(.*?),(.*)/,e=b.match(d),f=c(e[1].trim(),a),g=c(e[2].trim(),a),h=this.requiredDates.length;this.requiredDates.push({timestamp:f,format:g});return"[[_t_"+h+"]]"};z.prototype.addHelperFunction=function(a,b){return function(){return function(c,d){var e=w.reduce(function(a,c){if(b.hasOwnProperty(c)){a[c]=b[c]}return a},{});w.forEach(function(a){b[a]=function(){return""}});var f=a.apply(this,[b,c,d]);for(var g in e){b[g]=e[g]}return f}.bind(this)}.bind(this)};z.prototype.addHelpers=function(a,b){this.currentThemeName=b;this.requiredStrings=[];this.requiredJS=[];a.uniqid=p++;a.str=this.addHelperFunction(this.stringHelper,a);a.pix=this.addHelperFunction(this.pixHelper,a);a.js=this.addHelperFunction(this.jsHelper,a);a.quote=this.addHelperFunction(this.quoteHelper,a);a.shortentext=this.addHelperFunction(this.shortenTextHelper,a);a.userdate=this.addHelperFunction(this.userDateHelper,a);a.globals={config:g};a.currentTheme=b};z.prototype.getJS=function(){var a="";if(0").attr("type","text/javascript").html(a);b("head").append(c)}},B=function(a,c,d,e){var f=b(a);if(f.length){var g=b(c),h=null;if(e){h=new k.NodeList(f.children().get());h.destroy(!0);f.empty();f.append(g)}else{h=new k.NodeList(f.get());h.destroy(!0);f.replaceWith(g)}A(d);j.notifyFilterContentUpdated(g)}};z.prototype.scanForPartials=function(b){var c=a.parse(b),d=[],e=function(a,b){var c,d;for(c=0;c"==d[0]||"<"==d[0]){b.push(d[1])}if(4.\n\n/**\n * Template renderer for Moodle. Load and render Moodle templates with Mustache.\n *\n * @module core/templates\n * @package core\n * @class templates\n * @copyright 2015 Damyon Wiese \n * @license http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later\n * @since 2.9\n */\ndefine([\n 'core/mustache',\n 'jquery',\n 'core/ajax',\n 'core/str',\n 'core/notification',\n 'core/url',\n 'core/config',\n 'core/localstorage',\n 'core/icon_system',\n 'core/event',\n 'core/yui',\n 'core/log',\n 'core/truncate',\n 'core/user_date',\n 'core/pending',\n ],\n function(mustache, $, ajax, str, notification, coreurl, config, storage, IconSystem, event, Y, Log, Truncate, UserDate,\n Pending) {\n\n // Module variables.\n /** @var {Number} uniqInstances Count of times this constructor has been called. */\n var uniqInstances = 0;\n\n /** @var {String[]} templateCache - Cache of already loaded template strings */\n var templateCache = {};\n\n /** @var {Promise[]} templatePromises - Cache of already loaded template promises */\n var templatePromises = {};\n\n /** @var {Promise[]} cachePartialPromises - Cache of already loaded template partial promises */\n var cachePartialPromises = {};\n\n /** @var {Object} iconSystem - Object extending core/iconsystem */\n var iconSystem = {};\n\n /** @var {Object[]} loadTemplateBuffer - List of templates to be loaded */\n var loadTemplateBuffer = [];\n\n /** @var {Bool} isLoadingTemplates - Whether templates are currently being loaded */\n var isLoadingTemplates = false;\n\n /**\n * Search the various caches for a template promise for the given search key.\n * The search key should be in the format //