Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Spicerack #1612

Open
wants to merge 20 commits into
base: main
Choose a base branch
from
Open
Show file tree
Hide file tree
Changes from 2 commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions bin/bake.js
Original file line number Diff line number Diff line change
Expand Up @@ -28,6 +28,7 @@ const defaultConfig = {
domain: undefined,
embeds: 'embeds',
entrypoints: 'scripts/app.js',
imageSrcSizes: undefined,
input: process.cwd(),
layouts: '_layouts',
nunjucksVariables: undefined,
Expand Down Expand Up @@ -90,6 +91,7 @@ async function prepareConfig(inputOptions) {
options.domain = resolver('domain');
options.embeds = resolver('embeds');
options.entrypoints = resolver('entrypoints');
options.imageSrcSizes = resolver('imageSrcSizes');
options.input = resolver('input');
options.layouts = resolver('layouts');
options.nunjucksVariables = resolver('nunjucksVariables');
Expand Down
1 change: 0 additions & 1 deletion lib/engines/base.js
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,6 @@ import chokidar from 'chokidar';
import glob from 'fast-glob';

// local
import { getBasePath } from '../env.js';
import { noop, outputFile } from '../utils.js';

/**
Expand Down
23 changes: 23 additions & 0 deletions lib/filters/srcSets.js
Original file line number Diff line number Diff line change
@@ -0,0 +1,23 @@
import { Baker } from '../index.js';

function maxstache(str, ctx) {
return str
.split(/\{|\}/)
.map((t, i) => (!(i % 2) ? t : ctx[t]))
.join('');
}

/**
* @param {number[]} sizes
* @param {Baker} instance
**/
export function createSrcSetFilter(sizes, instance) {
return function createSrcSet(source) {
return sizes
.map((size) => {
const url = instance.getStaticPath(`${maxstache(source, { size })}`);
return `${url} ${size}w`;
})
.join(', ');
};
}
34 changes: 25 additions & 9 deletions lib/index.js
Original file line number Diff line number Diff line change
Expand Up @@ -38,6 +38,7 @@
import { NunjucksEngine } from './engines/nunjucks.js';
import { RollupEngine } from './engines/rollup.js';
import { SassEngine } from './engines/sass.js';
import { createSrcSetFilter } from './filters/srcSets.js';

const CROSSWALK_ALLOWED_ASSET_TYPES = [
'img',
Expand All @@ -60,6 +61,7 @@
* @property {string} data
* @property {string} [domain]
* @property {string} entrypoints
* @Property {{[key: string]: number[]}} imageSrcSizes
* @property {string} input
* @property {string} layouts
* @property {{[key: string]: (...args) => unknown}} [nunjucksVariables]
Expand All @@ -83,6 +85,7 @@
domain,
embeds,
entrypoints,
imageSrcSizes,
input,
layouts,
nunjucksVariables,
Expand Down Expand Up @@ -190,10 +193,7 @@
this.nunjucks.addCustomTag('inject', injectBlock);

// create our static tag
const staticBlock = createStaticBlock(
this.input,
[this.assets, this.sass]
);
const staticBlock = createStaticBlock(this.input, [this.assets, this.sass]);

// save a reference to our static block function for use elsewhere
// TODO: refactor away in v1
Expand All @@ -211,6 +211,17 @@
this.nunjucks.addCustomFilter('log', logFilter);
this.nunjucks.addCustomFilter('jsonScript', jsonScriptFilter);

// Add image size src set filters
if (imageSrcSizes) {
Object.keys(imageSrcSizes).forEach((size) => {
const srcSetFilterName = size.charAt(0).toUpperCase() + size.slice(1);
this.nunjucks.addCustomFilter(
srcSetFilterName,
createSrcSetFilter(size, this)
);
});
}

// if an object of custom nunjucks filters was provided, add them now
if (nunjucksFilters) {
this.nunjucks.addCustomFilters(nunjucksFilters);
Expand Down Expand Up @@ -320,7 +331,9 @@
}

if (!assetName) {
throw new Error('Crosswalk: Unable to process crowsswalk tsv/csv. Missing required \'assetName\' column.')
throw new Error(
"Crosswalk: Unable to process crowsswalk tsv/csv. Missing required 'assetName' column."
);
}

if (
Expand Down Expand Up @@ -359,9 +372,9 @@
return;
}

preppedData.assets[normalizedAssetType][normalizedAssetName][ext] =
this.getStaticPath(path);
});
preppedData.assets[normalizedAssetType][normalizedAssetName][ext] =

Check warning

Code scanning / CodeQL

Prototype-polluting assignment Medium

This assignment may alter Object.prototype if a malicious '__proto__' string is injected from
library input
.

Copilot Autofix AI 9 days ago

To fix the problem, we need to ensure that the keys used in the preppedData object cannot lead to prototype pollution. This can be achieved by:

  1. Validating the assetName and assetType to ensure they do not contain dangerous values like __proto__, constructor, or prototype.
  2. Using a Map object instead of a plain object for preppedData.assets to avoid prototype pollution.

The best way to fix the problem without changing existing functionality is to implement both of these measures. We will validate the keys and use a Map for preppedData.assets.

Suggested changeset 1
lib/index.js

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/lib/index.js b/lib/index.js
--- a/lib/index.js
+++ b/lib/index.js
@@ -308,3 +308,3 @@
     const preppedData = {
-      assets: {},
+      assets: new Map(),
       additionalData: []
@@ -361,7 +361,11 @@
 
-      if (!preppedData.assets[normalizedAssetType]) {
-        preppedData.assets[normalizedAssetType] = {};
+      if (['__proto__', 'constructor', 'prototype'].includes(normalizedAssetType) || ['__proto__', 'constructor', 'prototype'].includes(normalizedAssetName)) {
+        throw new Error('Invalid assetType or assetName');
       }
 
-      preppedData.assets[normalizedAssetType][normalizedAssetName] = {};
+      if (!preppedData.assets.has(normalizedAssetType)) {
+        preppedData.assets.set(normalizedAssetType, new Map());
+      }
+
+      preppedData.assets.get(normalizedAssetType).set(normalizedAssetName, new Map());
 
@@ -376,4 +380,3 @@
 
-        preppedData.assets[normalizedAssetType][normalizedAssetName][ext] =
-          this.getStaticPath(path);
+        preppedData.assets.get(normalizedAssetType).get(normalizedAssetName).set(ext, this.getStaticPath(path));
       });
EOF
@@ -308,3 +308,3 @@
const preppedData = {
assets: {},
assets: new Map(),
additionalData: []
@@ -361,7 +361,11 @@

if (!preppedData.assets[normalizedAssetType]) {
preppedData.assets[normalizedAssetType] = {};
if (['__proto__', 'constructor', 'prototype'].includes(normalizedAssetType) || ['__proto__', 'constructor', 'prototype'].includes(normalizedAssetName)) {
throw new Error('Invalid assetType or assetName');
}

preppedData.assets[normalizedAssetType][normalizedAssetName] = {};
if (!preppedData.assets.has(normalizedAssetType)) {
preppedData.assets.set(normalizedAssetType, new Map());
}

preppedData.assets.get(normalizedAssetType).set(normalizedAssetName, new Map());

@@ -376,4 +380,3 @@

preppedData.assets[normalizedAssetType][normalizedAssetName][ext] =
this.getStaticPath(path);
preppedData.assets.get(normalizedAssetType).get(normalizedAssetName).set(ext, this.getStaticPath(path));
});
Copilot is powered by AI and may make mistakes. Always verify output.
Positive Feedback
Negative Feedback

Provide additional feedback

Please help us improve GitHub Copilot by sharing more details about this comment.

Please select one or more of the options
this.getStaticPath(path);
});

return acc;
}, preppedData);
Expand Down Expand Up @@ -411,7 +424,10 @@
document.documentElement.clientHeight
);
});
await page.setViewport({ width: FIXED_FALLBACK_SCREENSHOT_WIDTH, height: contentHeight });
await page.setViewport({
width: FIXED_FALLBACK_SCREENSHOT_WIDTH,
height: contentHeight,
});

// store the fallback image in the _dist directory
const screenshotEmbedDir = join(this.output, embedFilePath)
Expand Down
Loading