domma-cms 1.8.5 → 1.8.6

package/CHANGELOG.md

@@ -1,5 +1,9 @@
 # Changelog
 
+## [1.8.6] - 2026-10-16
+
+- **Security: what is stored in a collection no longer runs as a shortcode.** A `[collection]` or `[view]` used to pass its entries on to the later shortcode steps, so an entry - a public form submission, say - holding `[form]`, `[button]`, `[embed]`, `[slideover]` or another `[collection]` was carried out on the page. Entry values now show exactly as typed, in every display type and in `{{field}}` / `{{{field}}}` block placeholders, while the page's own shortcodes and those written into a block template work as before. Filter, search and export still see the stored values. A value containing `$&` or `` $` `` is also shown as written instead of pulling in other parts of the page.
+
 ## [1.8.5] - 2026-10-16
 
 - **Import from WordPress brings custom post types across.** Content a theme or plugin added to WordPress - events, team members, portfolio pieces - now has its own Custom types section in the preview, with how many there are, a few titles, and what each will become. By default a type becomes a collection (wp-event, wp-team-member…) holding each item's title, address, text, excerpt, date, status and featured image, its categories, and every custom field it had, Advanced Custom Fields included - dates, numbers, links and pictures recognised as such. A list page at the type's old address (/events) shows the published ones, and the old single-item addresses and `?p=` links lead there; drafts come across but are never shown or readable from the site. Or choose Pages - each item a page at its old address, its categories as tags - or Skip. The type's address is read from the export's own links, never guessed. WordPress's and plugins' own housekeeping (revisions, reusable blocks, templates, form definitions, orders…) is listed once with why it is not imported. Run it again and entries you edited here are left alone unless you choose Overwrite, and a collection only ever gains fields - your own fields and labels stay.

package/CLAUDE.md

@@ -80,6 +80,13 @@ Containers that render their own body (tabs, accordion, carousel, timeline, hero
 wrappers) run the inline tags plus `[grid]`/`[card]` over it first - keep that set in step with
 `processInlineShortcodes()` when adding an inline tag. The full order is in `docs/markdown-shortcodes.md`.
 
+**Entry data never runs as a shortcode.** `[collection]` / `[view]` output carries entry values into stages 3-10,
+so every value they draw goes through `inertShortcodes()` (the character after each `[` becomes an entity, so
+`[form` is `[form` and nothing matches, while Markdown links in values still work): displays with no authored
+markup encode their whole output, block templates encode each `{{field}}` / `{{{field}}}` value and leave the
+template's own shortcodes live. A new display or placeholder must do the same. The base64 `data-ctx` / table
+payloads stay raw (no brackets in base64), so filter, search and export see the stored value.
+
 Safe nesting: `[card]` inside `[slideover]`, `[grid]` inside `[slideover]`, `[col]` inside `[grid]`, `[card]` inside
 `[box]` and `[box]` inside `[card]`.
 Do NOT nest `[slideover]` inside another `[slideover]`.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "domma-cms",
-  "version": "1.8.5",
+  "version": "1.8.6",
   "description": "File-based CMS powered by Domma and Fastify. Run npx domma-cms my-site to create a new project.",
   "type": "module",
   "main": "server/server.js",

package/server/services/markdown.js

@@ -57,6 +57,37 @@ marked.setOptions({
 // Collection shortcode helpers
 // ---------------------------------------------------------------------------
 
+/**
+ * Make text from a collection entry inert to the shortcode stages that run
+ * after `[collection]` / `[view]`.
+ *
+ * Entry values are DATA - public form submissions among them - and the
+ * rendered display is spliced into the page before tabs, form, embed, badge,
+ * button, card, slideover and the rest run, so a stored `[form id="x" /]`
+ * would otherwise be executed on the public page. Applied to the HTML that
+ * carries entry values (escaped text, attribute values, a rendered Markdown
+ * body, a `{{{raw}}}` placeholder), never to authored markup: a block
+ * template's own shortcodes still run.
+ *
+ * Every shortcode pattern starts `[name`, `[/name` or `[ name`, so the
+ * character after each `[` is written as a numeric entity (`[form` becomes
+ * `[form`) and a trailing `[` as `[`. Nothing can match, yet the
+ * brackets themselves stay, so a Markdown link in a value that a block
+ * template leaves to marked (`[text](url)`) is still a link. Entities read
+ * back as the same characters in text and attribute values, and the final
+ * sanitiser decodes them, so nothing visible changes; the base64 `data-ctx`
+ * / table payloads carry no brackets and are left as is, so filter, search
+ * and export see the stored values.
+ *
+ * @param {string} html - already-escaped HTML or text
+ * @returns {string}
+ */
+export function inertShortcodes(html) {
+    return String(html ?? '')
+        .replace(/\[([\w\s\/-])/g, (_, c) => `[&#${c.codePointAt(0)};`)
+        .replace(/\[$/, '[');
+}
+
 function escapeHtmlText(str) {
     return String(str ?? '')
         .replace(/&/g, '&')
@@ -349,7 +380,9 @@ function interpolateBlockTemplate(blockTemplate, e) {
     // One pass: a raw value put in (pre-rendered HTML) is never read again for
     // placeholders - text that shows "{{title}}" keeps it.
     return blockTemplate.replace(/\{\{\{(\w+)\}\}\}|\{\{([\w_]+)(?::([^{}]+))?\}\}/g, (_, raw, key, fmt) => {
-        if (raw !== undefined) return String(e.data?.[raw] ?? '');
+        // Entry values never carry a shortcode into the page (inertShortcodes);
+        // the template's own markup is untouched.
+        if (raw !== undefined) return inertShortcodes(String(e.data?.[raw] ?? ''));
         let value;
         if (key === '_id') value = e.id ?? '';
         else if (key === '_createdAt') value = e.meta?.createdAt ?? '';
@@ -357,9 +390,9 @@ function interpolateBlockTemplate(blockTemplate, e) {
         else value = e.data?.[key] ?? '';
         if (fmt) {
             const formatted = formatDate(value, fmt);
-            if (formatted !== null) return escapeHtmlText(formatted);
+            if (formatted !== null) return inertShortcodes(escapeHtmlText(formatted));
         }
-        return escapeHtmlText(value);
+        return inertShortcodes(escapeHtmlText(value));
     });
 }
 
@@ -401,14 +434,14 @@ function renderCollectionBlocks(entries, blockTemplate, emptyMsg, ctaOpts, cols,
 
     const items = entries.map(e => {
         const entryCls  = entryClassSuffix(ctxOpts).trim();
-        const wrapOpen  = `<div${entryCls ? ` class="${entryCls}"` : ''}${blockAttr} data-entry-id="${escapeAttr(String(e.id ?? ''))}">`;
+        const wrapOpen  = `<div${entryCls ? ` class="${entryCls}"` : ''}${blockAttr} data-entry-id="${inertShortcodes(escapeAttr(String(e.id ?? '')))}">`;
         const wrapClose = `</div>`;
         let html = interpolateBlockTemplate(blockTemplate, e);
 
         if (ctaOpts) {
             const ctaStyle = escapeAttr(ctaOpts.style || 'primary');
             let btnCls = `btn btn-${ctaStyle} dm-cta-trigger`;
-            let btnData = `data-action="${escapeAttr(ctaOpts.action)}" data-entry="${escapeAttr(e.id || '')}"`;
+            let btnData = `data-action="${escapeAttr(ctaOpts.action)}" data-entry="${inertShortcodes(escapeAttr(e.id || ''))}"`;
             if (ctaOpts.confirm) btnData += ` data-confirm="${escapeAttr(ctaOpts.confirm)}"`;
             if (ctaOpts.scope) btnData += ` data-scope="${escapeAttr(ctaOpts.scope)}"`;
             const iconHtml = ctaOpts.icon ? `<span data-icon="${escapeAttr(ctaOpts.icon)}"></span> ` : '';
@@ -636,15 +669,16 @@ function renderCollectionCards(entries, visibleFields, titleField, columns, empt
         if (ctaOpts) {
             const ctaStyle = escapeAttr(ctaOpts.style || 'primary');
             let btnCls = `btn btn-${ctaStyle} dm-cta-trigger`;
-            let btnData = `data-action="${escapeAttr(ctaOpts.action)}" data-entry="${escapeAttr(e.id || '')}"`;
+            let btnData = `data-action="${escapeAttr(ctaOpts.action)}" data-entry="${inertShortcodes(escapeAttr(e.id || ''))}"`;
             if (ctaOpts.confirm) btnData += ` data-confirm="${escapeAttr(ctaOpts.confirm)}"`;
             if (ctaOpts.scope) btnData += ` data-scope="${escapeAttr(ctaOpts.scope)}"`;
             const iconHtml = ctaOpts.icon ? `<span data-icon="${escapeAttr(ctaOpts.icon)}"></span> ` : '';
             footer = `<div class="card-footer"><button class="${btnCls}" ${btnData}>${iconHtml}${escapeHtmlText(ctaOpts.label || 'Run')}</button></div>`;
         }
-        return `<div class="card${entryClassSuffix(ctxOpts)}" data-entry-id="${escapeAttr(String(e.id ?? ''))}">${title ? `<div class="card-header">${title}</div>` : ''}<div class="card-body">${body || '&nbsp;'}</div>${footer}</div>`;
+        return `<div class="card${entryClassSuffix(ctxOpts)}" data-entry-id="${inertShortcodes(escapeAttr(String(e.id ?? '')))}">${title ? `<div class="card-header">${title}</div>` : ''}<div class="card-body">${body || '&nbsp;'}</div>${footer}</div>`;
     }).join('\n');
-    return `<div class="dm-collection-display grid ${responsiveGridCols(cols).join(' ')} gap-4"${buildCtxAttr(visibleFields, entries, ctxOpts)}>\n${cards}\n</div>`;
+    // No authored markup in this display - everything bracketed in it is entry data.
+    return inertShortcodes(`<div class="dm-collection-display grid ${responsiveGridCols(cols).join(' ')} gap-4"${buildCtxAttr(visibleFields, entries, ctxOpts)}>\n${cards}\n</div>`);
 }
 
 function renderCollectionList(entries, visibleFields, titleField, emptyMsg, ctaOpts, ctxOpts = {}) {
@@ -664,15 +698,16 @@ function renderCollectionList(entries, visibleFields, titleField, emptyMsg, ctaO
         if (ctaOpts) {
             const ctaStyle = escapeAttr(ctaOpts.style || 'primary');
             let btnCls = `btn btn-${ctaStyle} dm-cta-trigger`;
-            let btnData = `data-action="${escapeAttr(ctaOpts.action)}" data-entry="${escapeAttr(e.id || '')}"`;
+            let btnData = `data-action="${escapeAttr(ctaOpts.action)}" data-entry="${inertShortcodes(escapeAttr(e.id || ''))}"`;
             if (ctaOpts.confirm) btnData += ` data-confirm="${escapeAttr(ctaOpts.confirm)}"`;
             if (ctaOpts.scope) btnData += ` data-scope="${escapeAttr(ctaOpts.scope)}"`;
             const iconHtml = ctaOpts.icon ? `<span data-icon="${escapeAttr(ctaOpts.icon)}"></span> ` : '';
             ctaHtml = `<button class="${btnCls}" ${btnData}>${iconHtml}${escapeHtmlText(ctaOpts.label || 'Run')}</button>`;
         }
-        return `<div class="dm-collection-list-item${entryClassSuffix(ctxOpts)}" data-entry-id="${escapeAttr(String(e.id ?? ''))}">${title ? `<strong>${title}</strong>` : ''}${rest}${ctaHtml}</div>`;
+        return `<div class="dm-collection-list-item${entryClassSuffix(ctxOpts)}" data-entry-id="${inertShortcodes(escapeAttr(String(e.id ?? '')))}">${title ? `<strong>${title}</strong>` : ''}${rest}${ctaHtml}</div>`;
     }).join('\n');
-    return `<div class="dm-collection-display dm-collection-list"${buildCtxAttr(visibleFields, entries, ctxOpts)}>\n${items}\n</div>`;
+    // No authored markup in this display - everything bracketed in it is entry data.
+    return inertShortcodes(`<div class="dm-collection-display dm-collection-list"${buildCtxAttr(visibleFields, entries, ctxOpts)}>\n${items}\n</div>`);
 }
 
 /**
@@ -695,7 +730,7 @@ function renderCollectionAccordion(entries, titleField, bodyField, multiple, emp
         const bodyVal = String(e.data?.[bodyField] ?? '');
         const bodyHtml = marked.parse(bodyVal);
         return (
-            `<div class="accordion-item${entryClassSuffix(ctxOpts)}" data-entry-id="${escapeAttr(String(e.id ?? ''))}">\n` +
+            `<div class="accordion-item${entryClassSuffix(ctxOpts)}" data-entry-id="${inertShortcodes(escapeAttr(String(e.id ?? '')))}">\n` +
             `  <h3 class="accordion-header"><button class="accordion-button" type="button">${title}` +
             `<span class="accordion-icon" data-icon="chevron-down"></span></button></h3>\n` +
             `  <div class="accordion-body"><div class="accordion-content">${bodyHtml}</div></div>\n` +
@@ -704,7 +739,8 @@ function renderCollectionAccordion(entries, titleField, bodyField, multiple, emp
     }).join('\n');
 
     const ctx = buildCtxAttr([{name: titleField}, {name: bodyField}], entries, ctxOpts);
-    return `<div class="dm-collection-display accordion"${multiAttr}${ctx}>\n${items}\n</div>`;
+    // No authored markup in this display - everything bracketed in it is entry data.
+    return inertShortcodes(`<div class="dm-collection-display accordion"${multiAttr}${ctx}>\n${items}\n</div>`);
 }
 
 /**
@@ -740,7 +776,7 @@ function renderCollectionTimeline(entries, opts, ctxOpts = {}) {
         const bodyHtml = bodyField
             ? marked.parse(String(e.data?.[bodyField] ?? ''))
             : '';
-        return `<div class="dm-progression-item${entryClassSuffix(ctxOpts)}" data-entry-id="${escapeAttr(String(e.id ?? ''))}"${date}${status}${icon}><div class="dm-progression-item-title">${title}</div><div class="dm-progression-item-body">${bodyHtml}</div></div>`;
+        return `<div class="dm-progression-item${entryClassSuffix(ctxOpts)}" data-entry-id="${inertShortcodes(escapeAttr(String(e.id ?? '')))}"${date}${status}${icon}><div class="dm-progression-item-title">${title}</div><div class="dm-progression-item-body">${bodyHtml}</div></div>`;
     }).join('\n');
 
     const ctx = buildCtxAttr(
@@ -748,7 +784,8 @@ function renderCollectionTimeline(entries, opts, ctxOpts = {}) {
         entries,
         ctxOpts
     );
-    return `<div class="dm-collection-display dm-progression" data-layout="${layout}" data-theme="${theme}" data-mode="${mode}"${ctx}>\n${items}\n</div>`;
+    // No authored markup in this display - everything bracketed in it is entry data.
+    return inertShortcodes(`<div class="dm-collection-display dm-progression" data-layout="${layout}" data-theme="${theme}" data-mode="${mode}"${ctx}>\n${items}\n</div>`);
 }
 
 /**
@@ -799,9 +836,9 @@ function renderCollectionCarousel(entries, opts, ctxOpts = {}) {
             const bodyHtml = bodyField && e.data?.[bodyField] != null
                 ? `<div class="carousel-slide-description">${marked.parse(String(e.data[bodyField]))}</div>`
                 : '';
-            inner = img + (title || bodyHtml ? `<div class="carousel-slide-content">${title}${bodyHtml}</div>` : '');
+            inner = inertShortcodes(img + (title || bodyHtml ? `<div class="carousel-slide-content">${title}${bodyHtml}</div>` : ''));
         }
-        return `<div class="carousel-slide${entryClassSuffix(ctxOpts)}" data-entry-id="${escapeAttr(String(e.id ?? ''))}">${inner}</div>`;
+        return `<div class="carousel-slide${entryClassSuffix(ctxOpts)}" data-entry-id="${inertShortcodes(escapeAttr(String(e.id ?? '')))}">${inner}</div>`;
     }).join('\n');
 
     const ctxFields = blockTemplate
@@ -892,9 +929,9 @@ function renderCollectionListgroup(entries, opts, ctxOpts = {}) {
             const body = bodyField && e.data?.[bodyField] != null
                 ? `${title ? ' ' : ''}${marked.parseInline(String(e.data[bodyField]))}`
                 : '';
-            inner = (title + body) || escapeHtmlText(String(e.id ?? ''));
+            inner = inertShortcodes((title + body) || escapeHtmlText(String(e.id ?? '')));
         }
-        return `<div class="${itemClassStr}${entryClassSuffix(ctxOpts)}" data-entry-id="${escapeAttr(String(e.id ?? ''))}">${inner}</div>`;
+        return `<div class="${itemClassStr}${entryClassSuffix(ctxOpts)}" data-entry-id="${inertShortcodes(escapeAttr(String(e.id ?? '')))}">${inner}</div>`;
     }).join('\n');
 
     const ctxFields = blockTemplate
@@ -954,7 +991,7 @@ async function processViewBlocks(markdown, tagSet, user = null, flags = {}) {
         // browsing happens without the shortcode itself having to learn joins.
         if (isInteractiveCollection(attrs)) {
             const shell = await renderViewBrowserShell(attrs, {viewConfig, allowed, user});
-            result = result.replace(fullMatch, shell);
+            result = result.replace(fullMatch, () => shell);
             continue;
         }
 
@@ -1097,7 +1134,7 @@ async function processViewBlocks(markdown, tagSet, user = null, flags = {}) {
             replacement = `<div class="dm-view-wrapper${cls}"${id}>${replacement}</div>`;
         }
 
-        result = result.replace(fullMatch, replacement);
+        result = result.replace(fullMatch, () => replacement);
     }
 
     return restore(result);
@@ -1154,12 +1191,12 @@ async function processCollectionBlocks(markdown, tagSet) {
         // browser hydrates and replaces it).
         if (isInteractiveCollection(attrs)) {
             const shell = await renderCollectionBrowserShell(attrs);
-            result = result.replace(fullMatch, shell);
+            result = result.replace(fullMatch, () => shell);
             continue;
         }
 
         const replacement = await renderCollectionFragment(attrs);
-        result = result.replace(fullMatch, replacement);
+        result = result.replace(fullMatch, () => replacement);
     }
 
     return restore(result);