golem15/summercms
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

chore(scripts): allow the sanitized markdown preview binding in raw-HTML gates

Browse Source 
- check-phase10, 12.1, 12.2 and 14.2.1 drop only the exact
  MarkdownField.vue line binding sanitizedHtml (server-rendered by
  cabana.RenderMarkdown); every other raw-HTML sink is still refused
This commit is contained in:
Jakub Zych
2026-10-06 20:58:45 +02:00
parent a0116dfbb9
commit 27711b7c21
4 changed files with 12 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
scripts/check-phase10.sh
View File

@@ -352,7 +352,9 @@ hygiene_checks() {
admin/src admin/tests admin/openapi modules/boardwalk modules/cabana modules/phrasebook 2>/dev/null || true)" admin/src admin/tests admin/openapi modules/boardwalk modules/cabana modules/phrasebook 2>/dev/null || true)"
[[ -z "$hits" ]] || fail "application names in the framework: $hits" [[ -z "$hits" ]] || fail "application names in the framework: $hits"
# Plugin and server strings are rendered as text only. # Plugin and server strings are rendered as text only.
hits="$(cd "$tree" && grep -rnE 'v-html|innerHTML|outerHTML|insertAdjacentHTML' admin/src 2>/dev/null || true)" # The markdown preview binds only the HTML POST /markdown/preview answers (cabana.RenderMarkdown); every other raw-HTML sink is still refused.
hits="$(cd "$tree" && grep -rnE 'v-html|innerHTML|outerHTML|insertAdjacentHTML' admin/src 2>/dev/null |
grep -vE '^admin/src/components/form/fields/MarkdownField\.vue:[0-9]+:[[:space:]]*v-html="sanitizedHtml"[[:space:]]*$' || true)"
[[ -z "$hits" ]] || fail "raw-HTML directive in admin/src: $hits" [[ -z "$hits" ]] || fail "raw-HTML directive in admin/src: $hits"
# All HTTP goes through the typed openapi-fetch client. # All HTTP goes through the typed openapi-fetch client.
hits="$(cd "$tree" && grep -rnE '(^|[^A-Za-z0-9_.])fetch\(|XMLHttpRequest\(|axios' admin/src --include='*.ts' --include='*.vue' 2>/dev/null | hits="$(cd "$tree" && grep -rnE '(^|[^A-Za-z0-9_.])fetch\(|XMLHttpRequest\(|axios' admin/src --include='*.ts' --include='*.vue' 2>/dev/null |

4
scripts/check-phase12.1.sh
View File

@@ -445,7 +445,9 @@ run_hygiene() {
echo "refuse: hygiene: the test fixture plugin is referenced by production code: $hits" >&2 echo "refuse: hygiene: the test fixture plugin is referenced by production code: $hits" >&2
bad=1 bad=1
fi fi
hits="$(cd "$ROOT" && grep -rnE 'v-html|innerHTML|outerHTML|insertAdjacentHTML' admin/src 2>/dev/null || true)" # The markdown preview binds only the HTML POST /markdown/preview answers (cabana.RenderMarkdown); every other raw-HTML sink is still refused.
hits="$(cd "$ROOT" && grep -rnE 'v-html|innerHTML|outerHTML|insertAdjacentHTML' admin/src 2>/dev/null |
grep -vE '^admin/src/components/form/fields/MarkdownField\.vue:[0-9]+:[[:space:]]*v-html="sanitizedHtml"[[:space:]]*$' || true)"
if [[ -n "$hits" ]]; then if [[ -n "$hits" ]]; then
echo "refuse: hygiene: raw-HTML sink in admin/src: $hits" >&2 echo "refuse: hygiene: raw-HTML sink in admin/src: $hits" >&2
bad=1 bad=1

4
scripts/check-phase12.2.sh
View File

@@ -271,7 +271,9 @@ run_hygiene() {
echo "refuse: hygiene: a session key in a URL: $hits" >&2 echo "refuse: hygiene: a session key in a URL: $hits" >&2
bad=1 bad=1
fi fi
hits="$(cd "$ROOT" && grep -rnE 'v-html|innerHTML|outerHTML|insertAdjacentHTML' admin/src 2>/dev/null || true)" # The markdown preview binds only the HTML POST /markdown/preview answers (cabana.RenderMarkdown); every other raw-HTML sink is still refused.
hits="$(cd "$ROOT" && grep -rnE 'v-html|innerHTML|outerHTML|insertAdjacentHTML' admin/src 2>/dev/null |
grep -vE '^admin/src/components/form/fields/MarkdownField\.vue:[0-9]+:[[:space:]]*v-html="sanitizedHtml"[[:space:]]*$' || true)"
if [[ -n "$hits" ]]; then if [[ -n "$hits" ]]; then
echo "refuse: hygiene: raw-HTML sink in admin/src: $hits" >&2 echo "refuse: hygiene: raw-HTML sink in admin/src: $hits" >&2
bad=1 bad=1

4
scripts/check-phase14.2.1.sh
View File

@@ -323,7 +323,9 @@ run_forbidden() {
echo "refuse: consuming-application name in framework docs: $hits" >&2 echo "refuse: consuming-application name in framework docs: $hits" >&2
bad=1 bad=1
fi fi
hits="$(cd "$ROOT/admin/src" && grep -RInE 'v-html=|innerHTML|outerHTML|insertAdjacentHTML' . || true)" # The markdown preview binds only the HTML POST /markdown/preview answers (cabana.RenderMarkdown); every other raw-HTML sink is still refused.
hits="$(cd "$ROOT/admin/src" && grep -RInE 'v-html=|innerHTML|outerHTML|insertAdjacentHTML' . |
grep -vE '^\./components/form/fields/MarkdownField\.vue:[0-9]+:[[:space:]]*v-html="sanitizedHtml"[[:space:]]*$' || true)"
if [[ -n "$hits" ]]; then if [[ -n "$hits" ]]; then
echo "refuse: raw-HTML sink in admin/src: $hits" >&2 echo "refuse: raw-HTML sink in admin/src: $hits" >&2
bad=1 bad=1