Framework/Mustache
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix CVE-2022-0323 (improper neutralization of section names)

Browse Source 
- Fixes possible RCE when rendering untrusted user templates.
- Remove unnecessary comments in generated source.
This commit is contained in:
Justin Hileman
2022-01-21 01:08:36 -05:00
parent 076209772d
commit 579ffa5c96
1 changed files with 2 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/Mustache/Compiler.php
+2 -4
View File
@@ -320,7 +320,6 @@ class Mustache_Compiler
} }
const SECTION_CALL = ' const SECTION_CALL = '
// %s section
$value = $context->%s(%s);%s $value = $context->%s(%s);%s
$buffer .= $this->section%s($context, $indent, $value); $buffer .= $this->section%s($context, $indent, $value);
'; ';
@@ -391,11 +390,10 @@ class Mustache_Compiler
$id = var_export($id, true); $id = var_export($id, true);
$filters = $this->getFilters($filters, $level); $filters = $this->getFilters($filters, $level);
return sprintf($this->prepare(self::SECTION_CALL, $level), $id, $method, $id, $filters, $key); return sprintf($this->prepare(self::SECTION_CALL, $level), $method, $id, $filters, $key);
} }
const INVERTED_SECTION = ' const INVERTED_SECTION = '
// %s inverted section
$value = $context->%s(%s);%s $value = $context->%s(%s);%s
if (empty($value)) { if (empty($value)) {
%s %s
@@ -418,7 +416,7 @@ class Mustache_Compiler
$id = var_export($id, true); $id = var_export($id, true);
$filters = $this->getFilters($filters, $level); $filters = $this->getFilters($filters, $level);
return sprintf($this->prepare(self::INVERTED_SECTION, $level), $id, $method, $id, $filters, $this->walk($nodes, $level)); return sprintf($this->prepare(self::INVERTED_SECTION, $level), $method, $id, $filters, $this->walk($nodes, $level));
} }
const PARTIAL_INDENT = ', $indent . %s'; const PARTIAL_INDENT = ', $indent . %s';