Skip to content

Commit

Permalink
fix: set context data more safely (#14)
Browse files Browse the repository at this point in the history
  • Loading branch information
@dead-horse @popomore
dead-horse authored and popomore committed Apr 14, 2018
1 parent 2f22a95 commit ab29dee
Show file tree
Hide file tree
Showing 2 changed files with 12 additions and 19 deletions.
11 changes: 2 additions & 9 deletions lib/assets_context.js
View file
Expand Up @@ -48,7 +48,7 @@ class Assets {
getContext(data) {
data = safeStringify(data || this.assetsContext);
let ret = `<div id="${CONTEXT_TEMPLATE_ID}" style="display:none">${data}</div>\n`;
ret += `<script>window.${this.config.contextKey} = JSON.parse(document.getElementById('${CONTEXT_TEMPLATE_ID}').textContent || '{}');</script>`;
ret += `<script>window.${this.config.contextKey} = JSON.parse(decodeURIComponent(window.atob(document.getElementById('${CONTEXT_TEMPLATE_ID}').textContent)) || '{}');</script>`;
return ret;
}

Expand Down Expand Up @@ -82,16 +82,9 @@ function scriptTpl({ url }) {
return `<script src="${url}"></script>`;
}

const escapeMap = {
'<': '&lt;',
'>': '&gt;',
};
function safeStringify(data) {
if (!data) return '';
return JSON.stringify(data)
.replace(/[<>]/g, function(ch) {
return escapeMap[ch];
});
return new Buffer(encodeURIComponent(JSON.stringify(data))).toString('base64');
}

function normalizePublicPath(publicPath) {
Expand Down
20 changes: 10 additions & 10 deletions test/assets.test.js
View file
Expand Up @@ -29,7 +29,7 @@ describe('test/assets.test.js', () => {
.get('/')
.expect(/<div id="root"><\/div>/)
.expect(/<link rel="stylesheet" href="http:\/\/127.0.0.1:8000\/index.css"><\/link>/)
.expect(/style="display:none">{"data":1}<\/div>/)
.expect(/style="display:none">JTdCJTIyZGF0YSUyMiUzQTElN0Q=<\/div>/)
.expect(/<script src="http:\/\/127.0.0.1:8000\/index.js"><\/script>/)
.expect(/<script>window.__webpack_public_path__ = '\/';<\/script>/)
.expect(200);
Expand Down Expand Up @@ -61,7 +61,7 @@ describe('test/assets.test.js', () => {
.get('/')
.expect(/<div id="root"><\/div>/)
.expect(/<link rel="stylesheet" href="http:\/\/cdn.com\/app\/public\/index.b8e2efea.css"><\/link>/)
.expect(/style="display:none">{"data":1}<\/div>/)
.expect(/style="display:none">JTdCJTIyZGF0YSUyMiUzQTElN0Q=<\/div>/)
.expect(/<script src="http:\/\/cdn.com\/app\/public\/index.c4ae6394.js"><\/script>/)
.expect(/<script>window.__webpack_public_path__ = '\/app\/public\/';<\/script>/)
.expect(200);
Expand Down Expand Up @@ -95,7 +95,7 @@ describe('test/assets.test.js', () => {
it('should render context', () => {
return app.httpRequest()
.get('/context')
.expect(/style="display:none">{"data":1}<\/div>/)
.expect(/style="display:none">JTdCJTIyZGF0YSUyMiUzQTElN0Q=<\/div>/)
.expect(200);
});

Expand All @@ -104,7 +104,7 @@ describe('test/assets.test.js', () => {
.get('/options')
.expect(/<div id="root"><\/div>/)
.expect(/<link rel="stylesheet" href="http:\/\/127.0.0.1:8000\/index.css"><\/link>/)
.expect(/style="display:none">{}<\/div>/)
.expect(/style="display:none">JTdCJTdE<\/div>/)
.expect(/<script src="http:\/\/127.0.0.1:8000\/index.js"><\/script>/)
.expect(200);
});
Expand All @@ -115,14 +115,14 @@ describe('test/assets.test.js', () => {

await app.httpRequest()
.get('/cache')
.expect(/{"data":1}/)
.expect(/JTdCJTIyZGF0YSUyMiUzQTElN0Q=/)
.expect(200);

await fs.writeFile(template, 'override');

await app.httpRequest()
.get('/cache')
.expect(/{"data":1}/)
.expect(/JTdCJTIyZGF0YSUyMiUzQTElN0Q=/)
.expect(200);
});

Expand Down Expand Up @@ -173,7 +173,7 @@ describe('test/assets.test.js', () => {
return app.httpRequest()
.get('/')
.expect(/<link rel="stylesheet" href="http:\/\/127.0.0.1:8000\/index.css"><\/link>/)
.expect(/style="display:none">{"data":1}<\/div>/)
.expect(/style="display:none">JTdCJTIyZGF0YSUyMiUzQTElN0Q=<\/div>/)
.expect(/<script src="http:\/\/127.0.0.1:8000\/index.js"><\/script>/)
.expect(/<script>window.__webpack_public_path__ = '\/';<\/script>/)
.expect(/<script>window.resourceBaseUrl = 'http:\/\/127.0.0.1:8000\/';<\/script/)
Expand All @@ -195,7 +195,7 @@ describe('test/assets.test.js', () => {
return app.httpRequest()
.get('/')
.expect(/<link rel="stylesheet" href="http:\/\/cdn.com\/app\/public\/index.b8e2efea.css"><\/link>/)
.expect(/style="display:none">{"data":1}<\/div>/)
.expect(/style="display:none">JTdCJTIyZGF0YSUyMiUzQTElN0Q=<\/div>/)
.expect(/<script src="http:\/\/cdn.com\/app\/public\/index.c4ae6394.js"><\/script>/)
.expect(/<script>window.__webpack_public_path__ = '\/app\/public\/';<\/script>/)
.expect(/<script>window.resourceBaseUrl = 'http:\/\/cdn.com\/app\/public\/';<\/script/)
Expand Down Expand Up @@ -258,8 +258,8 @@ describe('test/assets.test.js', () => {
it('should GET /', () => {
return app.httpRequest()
.get('/?query=<x%E2%80%A8x>')
.expect(/<div id="[^"]+" style="display:none">\{"query":"&lt;x\u2028x&gt;"\}<\/div>/)
.expect(/window.context = JSON.parse\(document.getElementById\('[^']+'\).textContent \|\| '\{\}'\);/)
.expect(/<div id="[^"]+" style="display:none">JTdCJTIycXVlcnklMjIlM0ElMjIlM0N4JUUyJTgwJUE4eCUzRSUyMiU3RA==<\/div>/)
.expect(/window\.context = JSON\.parse\(decodeURIComponent\(window\.atob\(document\.getElementById\('[^']+'\).textContent\)\) \|\| '\{\}'\);/)
.expect(200);
});
});
Expand Down

0 comments on commit ab29dee

Please sign in to comment.