Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Small syntax enhancement to TMPLIT_EXPR #1033

Closed
svdb99 opened this issue Nov 21, 2024 · 11 comments
Closed

Small syntax enhancement to TMPLIT_EXPR #1033

svdb99 opened this issue Nov 21, 2024 · 11 comments

Comments

@svdb99
Copy link
Contributor

svdb99 commented Nov 21, 2024

This issue proposes a small enhancement to the regexp in the TMPLIT_EXPR const.

Background & Context

const TMPLIT_EXPR = seal(/\${[\w\W]*}/gm);

Projects that use XSLT can inline 3rd party libs before pushing out the response to the browser. While doing so they can perform code resolution/substitutions on ${} espressions. Unfortunately the ${[\w\W]*} part can be misinterpreted as an expression even though it's in a regexp, and because it obviously doesn't resolve to anything during the transformation, it gets wiped out as a result and causes a syntax error when the browser gets it.
Result: const TMPLIT_EXPR = seal(/\/gm);

Proposed workaround

The solution is extremely simple and doesn't change anything to how the regexp operates, and would improve compatibility with a wider range of mission critical projects build on "older" tech like XSLT.
All that is needed is to escape the first curly brace like so:
const TMPLIT_EXPR = seal(/\$\{[\w\W]*}/gm);

Would you like me to create a PR for this?

@cure53
Copy link
Owner

cure53 commented Nov 22, 2024

Heya, this looks good from my end, thanks - a PR is welcome 🙂

@svdb99
Copy link
Contributor Author

svdb99 commented Nov 25, 2024

Hi,
Unfortunately my access is read-only, it seems. I can't push my scratch branch.
"Permission to cure53/DOMPurify.git denied to svdb99."

@cure53
Copy link
Owner

cure53 commented Nov 26, 2024

You can just create a PR, then it works as expected :)

@svdb99 svdb99 mentioned this issue Nov 26, 2024
@svdb99
Copy link
Contributor Author

svdb99 commented Nov 26, 2024

Had to remember how to do it in this non-enterprise version of Github. It's a bit different than how we use it. 😅

@cure53
Copy link
Owner

cure53 commented Nov 28, 2024

We need some changes to the PR, see failed tests.

@svdb99
Copy link
Contributor Author

svdb99 commented Nov 28, 2024

The Lint error wants to optimize the regexp by removing the escape character I added.
This "optimization" is precisely what caused the issue in the first place.

svdb99 added a commit to svdb99/DOMPurify_TMPLIT_EXPR that referenced this issue Nov 29, 2024
svdb99 added a commit to svdb99/DOMPurify_TMPLIT_EXPR that referenced this issue Nov 29, 2024
@cure53 cure53 closed this as completed in 13e24e5 Nov 29, 2024
cure53 added a commit that referenced this issue Nov 29, 2024
@svdb99
Copy link
Contributor Author

svdb99 commented Nov 29, 2024

Hi, for some reason version 3.2.2 doesn't contain the fix.
When downloading the zip I can see the fix is in the .ts in the src folder, but it's not included in the files in the dist folder.

@cure53
Copy link
Owner

cure53 commented Nov 29, 2024

Oh, dang - somehow it indeed didn't make it into the dist files. Okay for you to wait for 3.2.3 for that?

@svdb99
Copy link
Contributor Author

svdb99 commented Nov 29, 2024

Yes, no pb, nothing's gonna happen until next week on our side.

@svanden99
Copy link

Hi,
Would you be able to tell me approximately when the next release is planned for?
Thanks!

@cure53
Copy link
Owner

cure53 commented Dec 6, 2024

Monday, the latest :)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

3 participants