Repository navigation
sec: many security issues fix - #90
Merged
Merged
Conversation
endStack() recompiled the already-rendered block buffer and getStack()
ran it back through renderString(), so any {{ }} reaching a block through
data was executed (e() escapes < > & " ' but not braces). The block body
is already compiled and executed with the page, so return the captured
output verbatim instead of compiling and rendering it a second time.
Add regression tests at the StackManager unit level and end-to-end through
a layout, asserting injected template syntax comes back as literal text.
- render()/executePlainRendering(): extract user data with EXTR_SKIP and pin the engine's own variables ($__tintin, the compiled path) before it, so a data key such as __tintin or __template can no longer overwrite the engine handle (DoS) or redirect which view file is required (view-selection hijack). - createTmpFile(): use tempnam() (atomic, unique, mode 0600) in a 0700 dir instead of a predictable md5(microtime()) name in a shared, world-readable directory, closing a local symlink/TOCTOU and disclosure window. - %json() without explicit options now defaults to JSON_HEX_TAG | JSON_HEX_APOS | JSON_HEX_QUOT | JSON_HEX_AMP so values cannot break out of a <script> context (XSS). - Filesystem::getFileResolvedPath() enforces that a resolved view path stays inside the configured directory (defense-in-depth against path traversal). Add regression tests for each.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.