marko 5.38.35 → 5.38.36

package/dist/runtime/html/helpers/escape-comment-placeholder.js

@@ -0,0 +1,17 @@
+"use strict";
+const unsafeCharsReg = />/g;
+const replaceMatch = () => ">";
+const escape = (str) =>
+unsafeCharsReg.test(str) ? str.replace(unsafeCharsReg, replaceMatch) : str;
+
+/**
+ * Escapes content placed inside an <html-comment> tag.
+ *
+ * For example:
+ * <html-comment>${userInput}</html-comment>
+ *
+ * Without escaping, a value of `><script>alert(1)</script><!--` would close the comment early.
+ */
+module.exports = function escapeCommentHelper(value) {
+  return escape(value + "");
+};

package/dist/runtime/html/helpers/escape-script-placeholder.js

@@ -1,5 +1,5 @@
 "use strict";
-const unsafeCharsReg = /<\/script/g;
+const unsafeCharsReg = /<\/script/gi;
 const replaceMatch = () => "\\x3C/script";
 const escape = (str) =>
 unsafeCharsReg.test(str) ? str.replace(unsafeCharsReg, replaceMatch) : str;

package/dist/runtime/html/helpers/escape-style-placeholder.js

@@ -1,5 +1,5 @@
 "use strict";
-const unsafeCharsReg = /<\/style/g;
+const unsafeCharsReg = /<\/style/gi;
 const replaceMatch = () => "\\3C/style";
 const escape = (str) =>
 unsafeCharsReg.test(str) ? str.replace(unsafeCharsReg, replaceMatch) : str;

package/dist/translator/taglib/core/translate-html-comment.js

@@ -5,6 +5,7 @@ var _babelUtils = require("@marko/compiler/babel-utils");
 
 
 
+
 var _htmlOutWrite = _interopRequireDefault(require("../../util/html-out-write"));
 var _vdomOutWrite = _interopRequireDefault(require("../../util/vdom-out-write"));
 var _withPreviousLocation = _interopRequireDefault(require("../../util/with-previous-location"));function _interopRequireDefault(e) {return e && e.__esModule ? e : { default: e };}
@@ -15,11 +16,30 @@ function enter(path) {
   (0, _babelUtils.assertNoAttributes)(path);
 
   if (path.hub.file.markoOpts.output === "html") {
-    path.replaceWithMultiple([
-    (0, _htmlOutWrite.default)`<!--`,
-    ...path.node.body.body,
-    (0, _htmlOutWrite.default)`-->`]
-    );
+    const { file } = path.hub;
+    const nodes = [(0, _htmlOutWrite.default)`<!--`];
+
+    for (const child of path.node.body.body) {
+      if (_compiler.types.isMarkoText(child)) {
+        nodes.push(child);
+      } else if (_compiler.types.isMarkoPlaceholder(child)) {
+        const escapeFnModule = child.escape ?
+        "marko/src/runtime/html/helpers/escape-comment-placeholder.js" :
+        "marko/src/runtime/helpers/to-string.js";
+        const escapeFnAlias = child.escape ?
+        "marko_escapeComment" :
+        "marko_to_string";
+        nodes.push(
+          (0, _htmlOutWrite.default)`${_compiler.types.callExpression(
+            (0, _babelUtils.importDefault)(file, escapeFnModule, escapeFnAlias),
+            [child.value]
+          )}`
+        );
+      }
+    }
+
+    nodes.push((0, _htmlOutWrite.default)`-->`);
+    path.replaceWithMultiple(nodes.filter(Boolean));
   } else {
     const templateQuasis = [];
     const templateExpressions = [];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "marko",
-  "version": "5.38.35",
+  "version": "5.38.36",
   "description": "UI Components + streaming, async, high performance, HTML templating for Node.js and the browser.",
   "keywords": [
     "front-end",
@@ -70,7 +70,7 @@
   },
   "dependencies": {
     "@marko/compiler": "^5.39.62",
-    "@marko/runtime-tags": "^6.0.162",
+    "@marko/runtime-tags": "^6.0.164",
     "app-module-path": "^2.2.0",
     "argly": "^1.2.0",
     "browser-refresh-client": "1.1.4",

package/src/runtime/html/helpers/escape-comment-placeholder.js

@@ -0,0 +1,17 @@
+"use strict";
+const unsafeCharsReg = />/g;
+const replaceMatch = () => ">";
+const escape = (str) =>
+  unsafeCharsReg.test(str) ? str.replace(unsafeCharsReg, replaceMatch) : str;
+
+/**
+ * Escapes content placed inside an <html-comment> tag.
+ *
+ * For example:
+ * <html-comment>${userInput}</html-comment>
+ *
+ * Without escaping, a value of `><script>alert(1)</script><!--` would close the comment early.
+ */
+module.exports = function escapeCommentHelper(value) {
+  return escape(value + "");
+};

package/src/runtime/html/helpers/escape-script-placeholder.js

@@ -1,5 +1,5 @@
 "use strict";
-const unsafeCharsReg = /<\/script/g;
+const unsafeCharsReg = /<\/script/gi;
 const replaceMatch = () => "\\x3C/script";
 const escape = (str) =>
   unsafeCharsReg.test(str) ? str.replace(unsafeCharsReg, replaceMatch) : str;

package/src/runtime/html/helpers/escape-style-placeholder.js

@@ -1,5 +1,5 @@
 "use strict";
-const unsafeCharsReg = /<\/style/g;
+const unsafeCharsReg = /<\/style/gi;
 const replaceMatch = () => "\\3C/style";
 const escape = (str) =>
   unsafeCharsReg.test(str) ? str.replace(unsafeCharsReg, replaceMatch) : str;

package/src/translator/taglib/core/translate-html-comment.js

@@ -3,6 +3,7 @@ import {
   assertNoArgs,
   assertNoAttributes,
   assertNoParams,
+  importDefault,
 } from "@marko/compiler/babel-utils";
 
 import writeHTML from "../../util/html-out-write";
@@ -15,11 +16,30 @@ export function enter(path) {
   assertNoAttributes(path);
 
   if (path.hub.file.markoOpts.output === "html") {
-    path.replaceWithMultiple([
-      writeHTML`<!--`,
-      ...path.node.body.body,
-      writeHTML`-->`,
-    ]);
+    const { file } = path.hub;
+    const nodes = [writeHTML`<!--`];
+
+    for (const child of path.node.body.body) {
+      if (t.isMarkoText(child)) {
+        nodes.push(child);
+      } else if (t.isMarkoPlaceholder(child)) {
+        const escapeFnModule = child.escape
+          ? "marko/src/runtime/html/helpers/escape-comment-placeholder.js"
+          : "marko/src/runtime/helpers/to-string.js";
+        const escapeFnAlias = child.escape
+          ? "marko_escapeComment"
+          : "marko_to_string";
+        nodes.push(
+          writeHTML`${t.callExpression(
+            importDefault(file, escapeFnModule, escapeFnAlias),
+            [child.value],
+          )}`,
+        );
+      }
+    }
+
+    nodes.push(writeHTML`-->`);
+    path.replaceWithMultiple(nodes.filter(Boolean));
   } else {
     const templateQuasis = [];
     const templateExpressions = [];