From d5ac2c69cfc2d490b2c003000b1db25c6706cfdf Mon Sep 17 00:00:00 2001
From: Ryan Wyllie <ryan@moodle.com>
Date: Tue, 3 Sep 2019 12:59:42 +0800
Subject: [PATCH] MDL-62284 javascript: prevent nested JS mustache handler
 calls

Prevent the JS mustache helper from being executed from within
the render call of another mustache helper because it can allow
users to inject JS into the page.
---
 lib/amd/build/templates.min.js |  2 +-
 lib/amd/src/templates.js       | 81 ++++++++++++++++++++++++++--------
 2 files changed, 64 insertions(+), 19 deletions(-)

diff --git a/lib/amd/build/templates.min.js b/lib/amd/build/templates.min.js
index 3357ba4ec4f..6d3274700fc 100644
--- a/lib/amd/build/templates.min.js
+++ b/lib/amd/build/templates.min.js
@@ -1 +1 @@
-define(["core/mustache","jquery","core/ajax","core/str","core/notification","core/url","core/config","core/localstorage","core/icon_system","core/event","core/yui","core/log","core/truncate","core/user_date","core/pending"],function(a,b,c,d,e,f,g,h,i,j,k,l,m,n,o){var p=0,q={},r={},s={},t={},u=function(){this.requiredStrings=[],this.requiredJS=[],this.requiredDates=[],this.currentThemeName=""};u.prototype.requiredStrings=null,u.prototype.requiredDates=[],u.prototype.requiredJS=null,u.prototype.currentThemeName="",u.prototype.getTemplate=function(a){var d=a.split("/"),e=d.shift(),f=d.shift(),g=this.currentThemeName+"/"+a;if(g in r)return r[g];var i=h.get("core_template/"+g);if(i)return q[g]=i,r[g]=b.Deferred().resolve(i).promise(),r[g];var j=c.call([{methodname:"core_output_load_template",args:{component:e,template:f,themename:this.currentThemeName}}],!0,!1);return r[g]=j[0].then(function(a){return q[g]=a,h.set("core_template/"+g,a),a}),r[g]},u.prototype.partialHelper=function(a){var b=this.currentThemeName+"/"+a;return b in q||e.exception(new Error("Failed to pre-fetch the template: "+a)),q[b]},u.prototype.renderIcon=function(a,c,d){var f=g.iconsystemmodule,h=b.Deferred();return require([f],function(a){var b=new a;b instanceof i?(t=b,b.init().then(h.resolve)["catch"](e.exception)):h.reject("Invalid icon system specified"+g.iconsystemmodule)}),h.then(function(a){return this.getTemplate(a.getTemplateName())}.bind(this)).then(function(b){return t.renderIcon(a,c,d,b)})},u.prototype.pixHelper=function(a,b,c){var d=b.split(","),e="",f="",g="";d.length>0&&(e=c(d.shift().trim(),a)),d.length>0&&(f=c(d.shift().trim(),a)),d.length>0&&(g=c(d.join(",").trim(),a));var h=t.getTemplateName(),i=this.currentThemeName+"/"+h,j=q[i];return e=e.replace(/&#x2F;/gi,"/"),t.renderIcon(e,f,g,j)},u.prototype.jsHelper=function(a,b,c){return this.requiredJS.push(c(b,a)),""},u.prototype.stringHelper=function(a,b,c){var d=b.split(","),e="",f="",g="";d.length>0&&(e=d.shift().trim()),d.length>0&&(f=d.shift().trim()),d.length>0&&(g=d.join(",").trim()),""!==g&&(g=c(g,a)),0===g.indexOf("{")&&0!==g.indexOf("{{")&&(g=JSON.parse(g));var h=this.requiredStrings.length;return this.requiredStrings.push({key:e,component:f,param:g}),"[[_s"+h+"]]"},u.prototype.quoteHelper=function(a,b,c){var d=c(b.trim(),a);return d=d.replace('"','\\"').replace(/([\{\}]{2,3})/g,"{{=<% %>=}}$1<%={{ }}=%>"),'"'+d+'"'},u.prototype.shortenTextHelper=function(a,b,c){var d=/(.*?),(.*)/,e=b.match(d),f=e[1].trim(),g=e[2].trim(),h=c(g,a);return m.truncate(h,{length:f,words:!0,ellipsis:"..."})},u.prototype.userDateHelper=function(a,b,c){var d=/(.*?),(.*)/,e=b.match(d),f=c(e[1].trim(),a),g=c(e[2].trim(),a),h=this.requiredDates.length;return this.requiredDates.push({timestamp:f,format:g}),"[[_t_"+h+"]]"},u.prototype.addHelpers=function(a,b){this.currentThemeName=b,this.requiredStrings=[],this.requiredJS=[],a.uniqid=p++,a.str=function(){return this.stringHelper.bind(this,a)}.bind(this),a.pix=function(){return this.pixHelper.bind(this,a)}.bind(this),a.js=function(){return this.jsHelper.bind(this,a)}.bind(this),a.quote=function(){return this.quoteHelper.bind(this,a)}.bind(this),a.shortentext=function(){return this.shortenTextHelper.bind(this,a)}.bind(this),a.userdate=function(){return this.userDateHelper.bind(this,a)}.bind(this),a.globals={config:g},a.currentTheme=b},u.prototype.getJS=function(){var a="";return this.requiredJS.length>0&&(a=this.requiredJS.join(";\n")),a},u.prototype.treatStringsInContent=function(a,b){var c,d,e,f,g,h,i=/\[\[_s\d+\]\]/;do{for(c="",d=a.search(i);d>-1;){c+=a.substring(0,d),a=a.substr(d),e="",f=4,g=a.substr(f,1);do e+=g,f++,g=a.substr(f,1);while("]"!=g);h=b[parseInt(e,10)],"undefined"==typeof h&&(l.debug("Could not find string for pattern [[_s"+e+"]]."),h=""),c+=h,a=a.substr(6+e.length),d=a.search(i)}a=c+a,d=a.search(i)}while(d>-1);return a},u.prototype.treatDatesInContent=function(a,b){return b.forEach(function(b,c){var d="\\[\\[_t_"+c+"\\]\\]",e=new RegExp(d,"g");a=a.replace(e,b)}),a},u.prototype.doRender=function(c,e,f){this.currentThemeName=f;var g=t.getTemplateName(),h=new o("core/templates:doRender");return this.getTemplate(g).then(function(){this.addHelpers(e,f);var d=a.render(c,e,this.partialHelper.bind(this));return b.Deferred().resolve(d.trim(),this.getJS()).promise()}.bind(this)).then(function(a,c){return this.requiredStrings.length>0?d.get_strings(this.requiredStrings).then(function(d){return this.requiredDates=this.requiredDates.map(function(a){return{timestamp:this.treatStringsInContent(a.timestamp,d),format:this.treatStringsInContent(a.format,d)}}.bind(this)),a=this.treatStringsInContent(a,d),c=this.treatStringsInContent(c,d),b.Deferred().resolve(a,c).promise()}.bind(this)):b.Deferred().resolve(a,c).promise()}.bind(this)).then(function(a,c){return this.requiredDates.length>0?n.get(this.requiredDates).then(function(d){return a=this.treatDatesInContent(a,d),c=this.treatDatesInContent(c,d),b.Deferred().resolve(a,c).promise()}.bind(this)):b.Deferred().resolve(a,c).promise()}.bind(this)).then(function(a,c){return h.resolve(),b.Deferred().resolve(a,c).promise()})};var v=function(a){if(""!==a.trim()){var c=b("<script>").attr("type","text/javascript").html(a);b("head").append(c)}},w=function(a,c,d,e){var f=b(a);if(f.length){var g=b(c),h=null;e?(h=new k.NodeList(f.children().get()),h.destroy(!0),f.empty(),f.append(g)):(h=new k.NodeList(f.get()),h.destroy(!0),f.replaceWith(g)),v(d),j.notifyFilterContentUpdated(g)}};u.prototype.scanForPartials=function(b){var c=a.parse(b),d=[],e=function(a,b){var c,d;for(c=0;c<a.length;c++)d=a[c],">"!=d[0]&&"<"!=d[0]||b.push(d[1]),d.length>4&&e(d[4],b)};return e(c,d),d},u.prototype.cachePartials=function(a,c){var d=this.currentThemeName+"/"+a;return d in s?s[d]:(c=c||[d],s[d]=b.Deferred(),this.getTemplate(a).then(function(e){var f=this.scanForPartials(e),g=f.filter(function(b){return!(c.indexOf(this.currentThemeName+"/"+b)>=0)&&b!=a}.bind(this)),h=g.map(function(a){return c.push(this.currentThemeName+"/"+a),this.cachePartials(a,c)}.bind(this));return b.when.apply(b,h).then(function(){return s[d].resolve(e)})}.bind(this))["catch"](s[d].reject),s[d])},u.prototype.render=function(a,c,d){"undefined"==typeof d&&(d=g.theme),this.currentThemeName=d;var f=g.iconsystemmodule,h=b.Deferred();return require([f],function(a){var b=new a;b instanceof i?(t=b,b.init().then(h.resolve)["catch"](e.exception)):h.reject("Invalid icon system specified"+g.iconsystem)}),h.then(function(){return this.cachePartials(a)}.bind(this)).then(function(a){return this.doRender(a,c,d)}.bind(this))};var x=function(a,c,d){var e=b(a);e.length&&(e.prepend(c),v(d),j.notifyFilterContentUpdated(e))},y=function(a,c,d){var e=b(a);e.length&&(e.append(c),v(d),j.notifyFilterContentUpdated(e))};return{render:function(a,b,c){var d=new u;return d.render(a,b,c)},renderPix:function(a,b,c){var d=new u;return d.renderIcon(a,b,c)},runTemplateJS:v,replaceNodeContents:function(a,b,c){w(a,b,c,!0)},replaceNode:function(a,b,c){w(a,b,c,!1)},prependNodeContents:function(a,b,c){x(a,b,c)},appendNodeContents:function(a,b,c){y(a,b,c)}}});
\ No newline at end of file
+define(["core/mustache","jquery","core/ajax","core/str","core/notification","core/url","core/config","core/localstorage","core/icon_system","core/event","core/yui","core/log","core/truncate","core/user_date","core/pending"],function(a,b,c,d,e,f,g,h,i,j,k,l,m,n,o){var p=0,q={},r={},s={},t={},u=["js"],v=function(){this.requiredStrings=[],this.requiredJS=[],this.requiredDates=[],this.currentThemeName=""};v.prototype.requiredStrings=null,v.prototype.requiredDates=[],v.prototype.requiredJS=null,v.prototype.currentThemeName="",v.prototype.getTemplate=function(a){var d=a.split("/"),e=d.shift(),f=d.shift(),g=this.currentThemeName+"/"+a;if(g in r)return r[g];var i=h.get("core_template/"+g);if(i)return q[g]=i,r[g]=b.Deferred().resolve(i).promise(),r[g];var j=c.call([{methodname:"core_output_load_template",args:{component:e,template:f,themename:this.currentThemeName}}],!0,!1);return r[g]=j[0].then(function(a){return q[g]=a,h.set("core_template/"+g,a),a}),r[g]},v.prototype.partialHelper=function(a){var b=this.currentThemeName+"/"+a;return b in q||e.exception(new Error("Failed to pre-fetch the template: "+a)),q[b]},v.prototype.renderIcon=function(a,c,d){var f=g.iconsystemmodule,h=b.Deferred();return require([f],function(a){var b=new a;b instanceof i?(t=b,b.init().then(h.resolve)["catch"](e.exception)):h.reject("Invalid icon system specified"+g.iconsystemmodule)}),h.then(function(a){return this.getTemplate(a.getTemplateName())}.bind(this)).then(function(b){return t.renderIcon(a,c,d,b)})},v.prototype.pixHelper=function(a,b,c){var d=b.split(","),e="",f="",g="";d.length>0&&(e=c(d.shift().trim(),a)),d.length>0&&(f=c(d.shift().trim(),a)),d.length>0&&(g=c(d.join(",").trim(),a));var h=t.getTemplateName(),i=this.currentThemeName+"/"+h,j=q[i];return e=e.replace(/&#x2F;/gi,"/"),t.renderIcon(e,f,g,j)},v.prototype.jsHelper=function(a,b,c){return this.requiredJS.push(c(b,a)),""},v.prototype.stringHelper=function(a,b,c){var d=b.split(","),e="",f="",g="";d.length>0&&(e=d.shift().trim()),d.length>0&&(f=d.shift().trim()),d.length>0&&(g=d.join(",").trim()),""!==g&&(g=c(g,a)),0===g.indexOf("{")&&0!==g.indexOf("{{")&&(g=JSON.parse(g));var h=this.requiredStrings.length;return this.requiredStrings.push({key:e,component:f,param:g}),"[[_s"+h+"]]"},v.prototype.quoteHelper=function(a,b,c){var d=c(b.trim(),a);return d=d.replace('"','\\"').replace(/([\{\}]{2,3})/g,"{{=<% %>=}}$1<%={{ }}=%>"),'"'+d+'"'},v.prototype.shortenTextHelper=function(a,b,c){var d=/(.*?),(.*)/,e=b.match(d),f=e[1].trim(),g=e[2].trim(),h=c(g,a);return m.truncate(h,{length:f,words:!0,ellipsis:"..."})},v.prototype.userDateHelper=function(a,b,c){var d=/(.*?),(.*)/,e=b.match(d),f=c(e[1].trim(),a),g=c(e[2].trim(),a),h=this.requiredDates.length;return this.requiredDates.push({timestamp:f,format:g}),"[[_t_"+h+"]]"},v.prototype.addHelperFunction=function(a,b){return function(){return function(c,d){var e=u.reduce(function(a,c){return b.hasOwnProperty(c)&&(a[c]=b[c]),a},{});u.forEach(function(a){b[a]=function(){return""}});var f=a.apply(this,[b,c,d]);for(var g in e)b[g]=e[g];return f}.bind(this)}.bind(this)},v.prototype.addHelpers=function(a,b){this.currentThemeName=b,this.requiredStrings=[],this.requiredJS=[],a.uniqid=p++,a.str=this.addHelperFunction(this.stringHelper,a),a.pix=this.addHelperFunction(this.pixHelper,a),a.js=this.addHelperFunction(this.jsHelper,a),a.quote=this.addHelperFunction(this.quoteHelper,a),a.shortentext=this.addHelperFunction(this.shortenTextHelper,a),a.userdate=this.addHelperFunction(this.userDateHelper,a),a.globals={config:g},a.currentTheme=b},v.prototype.getJS=function(){var a="";return this.requiredJS.length>0&&(a=this.requiredJS.join(";\n")),a},v.prototype.treatStringsInContent=function(a,b){var c,d,e,f,g,h,i=/\[\[_s\d+\]\]/;do{for(c="",d=a.search(i);d>-1;){c+=a.substring(0,d),a=a.substr(d),e="",f=4,g=a.substr(f,1);do e+=g,f++,g=a.substr(f,1);while("]"!=g);h=b[parseInt(e,10)],"undefined"==typeof h&&(l.debug("Could not find string for pattern [[_s"+e+"]]."),h=""),c+=h,a=a.substr(6+e.length),d=a.search(i)}a=c+a,d=a.search(i)}while(d>-1);return a},v.prototype.treatDatesInContent=function(a,b){return b.forEach(function(b,c){var d="\\[\\[_t_"+c+"\\]\\]",e=new RegExp(d,"g");a=a.replace(e,b)}),a},v.prototype.doRender=function(c,e,f){this.currentThemeName=f;var g=t.getTemplateName(),h=new o("core/templates:doRender");return this.getTemplate(g).then(function(){this.addHelpers(e,f);var d=a.render(c,e,this.partialHelper.bind(this));return b.Deferred().resolve(d.trim(),this.getJS()).promise()}.bind(this)).then(function(a,c){return this.requiredStrings.length>0?d.get_strings(this.requiredStrings).then(function(d){return this.requiredDates=this.requiredDates.map(function(a){return{timestamp:this.treatStringsInContent(a.timestamp,d),format:this.treatStringsInContent(a.format,d)}}.bind(this)),a=this.treatStringsInContent(a,d),c=this.treatStringsInContent(c,d),b.Deferred().resolve(a,c).promise()}.bind(this)):b.Deferred().resolve(a,c).promise()}.bind(this)).then(function(a,c){return this.requiredDates.length>0?n.get(this.requiredDates).then(function(d){return a=this.treatDatesInContent(a,d),c=this.treatDatesInContent(c,d),b.Deferred().resolve(a,c).promise()}.bind(this)):b.Deferred().resolve(a,c).promise()}.bind(this)).then(function(a,c){return h.resolve(),b.Deferred().resolve(a,c).promise()})};var w=function(a){if(""!==a.trim()){var c=b("<script>").attr("type","text/javascript").html(a);b("head").append(c)}},x=function(a,c,d,e){var f=b(a);if(f.length){var g=b(c),h=null;e?(h=new k.NodeList(f.children().get()),h.destroy(!0),f.empty(),f.append(g)):(h=new k.NodeList(f.get()),h.destroy(!0),f.replaceWith(g)),w(d),j.notifyFilterContentUpdated(g)}};v.prototype.scanForPartials=function(b){var c=a.parse(b),d=[],e=function(a,b){var c,d;for(c=0;c<a.length;c++)d=a[c],">"!=d[0]&&"<"!=d[0]||b.push(d[1]),d.length>4&&e(d[4],b)};return e(c,d),d},v.prototype.cachePartials=function(a,c){var d=this.currentThemeName+"/"+a;return d in s?s[d]:(c=c||[d],s[d]=b.Deferred(),this.getTemplate(a).then(function(e){var f=this.scanForPartials(e),g=f.filter(function(b){return!(c.indexOf(this.currentThemeName+"/"+b)>=0)&&b!=a}.bind(this)),h=g.map(function(a){return c.push(this.currentThemeName+"/"+a),this.cachePartials(a,c)}.bind(this));return b.when.apply(b,h).then(function(){return s[d].resolve(e)})}.bind(this))["catch"](s[d].reject),s[d])},v.prototype.render=function(a,c,d){"undefined"==typeof d&&(d=g.theme),this.currentThemeName=d;var f=g.iconsystemmodule,h=b.Deferred();return require([f],function(a){var b=new a;b instanceof i?(t=b,b.init().then(h.resolve)["catch"](e.exception)):h.reject("Invalid icon system specified"+g.iconsystem)}),h.then(function(){return this.cachePartials(a)}.bind(this)).then(function(a){return this.doRender(a,c,d)}.bind(this))};var y=function(a,c,d){var e=b(a);e.length&&(e.prepend(c),w(d),j.notifyFilterContentUpdated(e))},z=function(a,c,d){var e=b(a);e.length&&(e.append(c),w(d),j.notifyFilterContentUpdated(e))};return{render:function(a,b,c){var d=new v;return d.render(a,b,c)},renderPix:function(a,b,c){var d=new v;return d.renderIcon(a,b,c)},runTemplateJS:w,replaceNodeContents:function(a,b,c){x(a,b,c,!0)},replaceNode:function(a,b,c){x(a,b,c,!1)},prependNodeContents:function(a,b,c){y(a,b,c)},appendNodeContents:function(a,b,c){z(a,b,c)}}});
\ No newline at end of file
diff --git a/lib/amd/src/templates.js b/lib/amd/src/templates.js
index 514f2106def..fedfdd17daa 100644
--- a/lib/amd/src/templates.js
+++ b/lib/amd/src/templates.js
@@ -59,6 +59,9 @@ define([
     /** @var {Object} iconSystem - Object extending core/iconsystem */
     var iconSystem = {};
 
+    /** @var {Array} blacklistedNestedHelpers - List of helpers that can't be called within other helpers */
+    var blacklistedNestedHelpers = ['js'];
+
     /**
      * Constructor
      *
@@ -357,6 +360,60 @@ define([
         return '[[_t_' + index + ']]';
     };
 
+    /**
+     * Return a helper function to be added to the context for rendering the a
+     * template.
+     *
+     * This will parse the provided text before giving it to the helper function
+     * in order to remove any blacklisted nested helpers to prevent one helper
+     * from calling another.
+     *
+     * In particular to prevent the JS helper from being called from within another
+     * helper because it can lead to security issues when the JS portion is user
+     * provided.
+     *
+     * @param  {function} helperFunction The helper function to add
+     * @param  {object} context The template context for the helper function
+     * @return {Function} To be set in the context
+     */
+    Renderer.prototype.addHelperFunction = function(helperFunction, context) {
+        return function() {
+            return function(sectionText, helper) {
+                // Override the blacklisted helpers in the template context with
+                // a function that returns an empty string for use when executing
+                // other helpers. This is to prevent these helpers from being
+                // executed as part of the rendering of another helper in order to
+                // prevent any potential security issues.
+                var originalHelpers = blacklistedNestedHelpers.reduce(function(carry, name) {
+                    if (context.hasOwnProperty(name)) {
+                        carry[name] = context[name];
+                    }
+
+                    return carry;
+                }, {});
+
+                blacklistedNestedHelpers.forEach(function(helperName) {
+                    context[helperName] = function() {
+                        return '';
+                    };
+                });
+
+                // Execute the helper with the modified context that doesn't include
+                // the blacklisted nested helpers. This prevents the blacklisted
+                // helpers from being called from within other helpers.
+                var result = helperFunction.apply(this, [context, sectionText, helper]);
+
+                // Restore the original helper implementation in the context so that
+                // any further rendering has access to them again.
+                for (var name in originalHelpers) {
+                    context[name] = originalHelpers[name];
+                }
+
+                return result;
+            }.bind(this);
+        }.bind(this);
+    };
+
     /**
      * Add some common helper functions to all context objects passed to templates.
      * These helpers match exactly the helpers available in php.
@@ -371,24 +428,12 @@ define([
         this.requiredStrings = [];
         this.requiredJS = [];
         context.uniqid = (uniqInstances++);
-        context.str = function() {
-          return this.stringHelper.bind(this, context);
-        }.bind(this);
-        context.pix = function() {
-          return this.pixHelper.bind(this, context);
-        }.bind(this);
-        context.js = function() {
-          return this.jsHelper.bind(this, context);
-        }.bind(this);
-        context.quote = function() {
-          return this.quoteHelper.bind(this, context);
-        }.bind(this);
-        context.shortentext = function() {
-          return this.shortenTextHelper.bind(this, context);
-        }.bind(this);
-        context.userdate = function() {
-          return this.userDateHelper.bind(this, context);
-        }.bind(this);
+        context.str = this.addHelperFunction(this.stringHelper, context);
+        context.pix = this.addHelperFunction(this.pixHelper, context);
+        context.js = this.addHelperFunction(this.jsHelper, context);
+        context.quote = this.addHelperFunction(this.quoteHelper, context);
+        context.shortentext = this.addHelperFunction(this.shortenTextHelper, context);
+        context.userdate = this.addHelperFunction(this.userDateHelper, context);
         context.globals = {config: config};
         context.currentTheme = themeName;
     };