Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

BUG 🐞: Injection problem when spaces are involved for attributes. #27

Closed
EmranMR opened this issue Aug 22, 2023 · 0 comments
Closed
Labels
bug Something isn't working

Comments

@EmranMR
Copy link
Owner

EmranMR commented Aug 22, 2023

There is bug, with html parsing, when an attribute directive is used as the first attribute in an html element.

<div  @class('test') id="test" style="test">

also see Laravel Nova Extension#11

Resulting tree output:
(blade [0, 0] - [0, 44]
  (php [0, 0] - [0, 4])
  (attribute [0, 6] - [0, 20]
    (directive [0, 6] - [0, 12])
    (parameter [0, 13] - [0, 19]))
  (php [0, 21] - [0, 44]))

This is correct... but since the spaces are not taken into account when injecting, the element's tag name is merged with attribute name, resulting in a tag name followed by a = breaking html injection 🫠

@EmranMR EmranMR added the bug Something isn't working label Aug 22, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working
Projects
None yet
Development

No branches or pull requests

1 participant