saasufy-components 7.11.0 → 7.12.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "saasufy-components",
-  "version": "7.11.0",
+  "version": "7.12.1",
   "description": "Components for Saasufy.",
   "main": "index.js",
   "scripts": {
@@ -17,7 +17,7 @@
   "author": "Jonathan Gros-Dubois",
   "license": "MIT",
   "dependencies": {
-    "ag-collection": "^5.3.1",
+    "ag-collection": "^5.3.2",
     "ag-model": "^3.1.0",
     "capitalisk-auth-client": "^1.5.1",
     "socketcluster-client": "^19.2.3",

package/utils.js

@@ -5,9 +5,23 @@ import { sha256 } from './sha256.js';
 
 const DEFAULT_DEBOUNCE_DELAY = 300;
 const DEFAULT_RELOAD_DELAY = 0;
+
+let expressionCharsRegExp = /\$\{(.*?)\}/g;
+let backtickRegExp = /`/g;
+let templateMultiStartBracesRegExp = /{{{*/g
+let templateMultiEndBracesRegExp = /}}}*/g
+
+export function toSafeString(value) {
+  return value.replace(expressionCharsRegExp, '$!{$1}')
+    .replace(backtickRegExp, `'`)
+    .replace(templateMultiStartBracesRegExp, '[[')
+    .replace(templateMultiEndBracesRegExp, ']]');
+}
+
 export function toSafeHTML(value) {
   if (typeof value === 'string') {
-    return value.replace(/&(?!(amp|lt|gt|quot|#039|#123|#125);)/g, '&')
+    return toSafeString(value)
+      .replace(/&(?!(amp|lt|gt|quot|#039|#123|#125);)/g, '&')
       .replace(/<(?!br ?\/?>)/g, '&lt;')
       .replace(/(?<!br ?\/?)>/g, '&gt;')
       .replace(/"/g, '&quot;')
@@ -296,9 +310,6 @@ function replaceExpressions(string, replaceFn) {
   return charList.join('');
 }
 
-let templateMultiStartBracesRegExp = /{{{*/g
-let templateMultiEndBracesRegExp = /}}}*/g
-
 export function renderTemplate(templateString, data, socket, autoExecFunction) {
   let options = getRenderOptions(data, socket);
   return replaceExpressions(templateString, (expression) => {
@@ -333,15 +344,6 @@ export function renderTemplate(templateString, data, socket, autoExecFunction) {
         }
         result = result();
       }
-      if (typeof result === 'string') {
-        // Double braces cannot contain sub-expressions as it
-        // would present an XSS vulnerability.
-        // Replace them with square braces so that any code inside
-        // will not be executed if output is re-processed later.
-        result = result
-          .replace(templateMultiStartBracesRegExp, '[[')
-          .replace(templateMultiEndBracesRegExp, ']]');
-      }
       return toSafeHTML(result);
     } catch (error) {
       return expression;