Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix(contribs/gnodev/pkg/emitter): use html/template not text/template for HTML generation #3545

Merged
merged 1 commit into from
Jan 20, 2025
Merged

fix(contribs/gnodev/pkg/emitter): use html/template not text/template for HTML generation #3545

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion contribs/gnodev/pkg/emitter/middleware.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,10 +5,10 @@ import (
_ "embed"
"encoding/json"
"fmt"
"html/template"
"net/http"
"strings"
"sync"
"text/template"

"github.com/gnolang/gno/contribs/gnodev/pkg/events"
)
Expand Down
43 changes: 43 additions & 0 deletions contribs/gnodev/pkg/emitter/middleware_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,43 @@
package emitter

import (
"fmt"
"net/http"
"net/http/httptest"
"regexp"
"testing"

"github.com/stretchr/testify/require"
)

func TestMiddlewareUsesHTMLTemplate(t *testing.T) {
tests := []struct {
name string
remote string
want string
}{
{"normal remote", "localhost:9999", "const ws = new WebSocket('ws://localhost:9999');"},
{"xss'd remote", `localhost:9999');alert('pwned`, "const ws = new WebSocket('ws://localhost:9999');alert('pwned');"},
}

// As the code revolves, add more search patterns here.
reWebsocket := regexp.MustCompile("const ws = new WebSocket[^\n]+")

for _, tt := range tests {
t.Run(tt.name, func(t *testing.T) {
rec := httptest.NewRecorder()
mdw := NewMiddleware(tt.remote, http.HandlerFunc(func(rw http.ResponseWriter, req *http.Request) {
rw.Header().Set("Content-Type", "text/html")
fmt.Fprintf(rw, "<body></body>")
}))
rec.Header().Set("Content-Type", "text/html")
req := httptest.NewRequest("GET", "https://gno.land/example", nil)
mdw.ServeHTTP(rec, req)

targets := reWebsocket.FindAllString(rec.Body.String(), -1)
require.True(t, len(targets) > 0)
body := targets[0]
require.Equal(t, body, tt.want)
})
}
}
4 changes: 3 additions & 1 deletion contribs/gnodev/pkg/emitter/static/hotreload.js
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,8 @@
(function() {
// Define the events that will trigger a page reload
const eventsReload = {{ .ReloadEvents | json }};
const eventsReload = [
{{range .ReloadEvents}}'{{.}}',{{end}}
];

// Establish the WebSocket connection to the event server
const ws = new WebSocket('ws://{{- .Remote -}}');
Expand Down
Loading