Skip to content

Commit c72d43d

Browse files
BadgeratiBadgerati
committed
Fix HTML encoding issues from Snyk, and DisplayName for more elements for encoding
1 parent f0bfdcc commit c72d43d

27 files changed

+186
-73
lines changed

‎examples/full.ps1

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -31,7 +31,7 @@ Start-PodeServer -StatusPageExceptions Show {
3131

3232

3333
# set the use of templates
34-
Use-PodeWebTemplates -Title Test -Logo '/pode.web/images/icon.png' -Theme Dark
34+
Use-PodeWebTemplates -Title 'Test' -Logo '/pode.web/images/icon.png' -Theme Dark
3535

3636
# set login page
3737
# -BackgroundImage '/images/galaxy.jpg'

‎src/Private/Helpers.ps1

Lines changed: 36 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -345,14 +345,27 @@ function Protect-PodeWebValue
345345

346346
[Parameter()]
347347
[string]
348-
$Default
348+
$Default,
349+
350+
[switch]
351+
$Encode
349352
)
350353

351354
if ([string]::IsNullOrWhiteSpace($Value)) {
352-
return $Default
355+
if ($Encode) {
356+
return [System.Net.WebUtility]::HtmlEncode($Default)
357+
}
358+
else {
359+
return $Default
360+
}
353361
}
354362

355-
return $Value
363+
if ($Encode) {
364+
return [System.Net.WebUtility]::HtmlEncode($Value)
365+
}
366+
else {
367+
return $Value
368+
}
356369
}
357370

358371
function Protect-PodeWebValues
@@ -367,18 +380,35 @@ function Protect-PodeWebValues
367380
$Default,
368381

369382
[switch]
370-
$EqualCount
383+
$EqualCount,
384+
385+
[switch]
386+
$Encode
371387
)
372388

373389
if (($null -eq $Value) -or ($Value.Length -eq 0)) {
374-
return $Default
390+
if ($Encode -and ($null -ne $Default) -and ($Default.Length -gt 0)) {
391+
return @(foreach ($v in $Default) {
392+
[System.Net.WebUtility]::HtmlEncode($v)
393+
})
394+
}
395+
else {
396+
return $Default
397+
}
375398
}
376399

377400
if ($EqualCount -and ($Value.Length -ne $Default.Length)) {
378401
throw "Expected an equal number of values in both arrays"
379402
}
380403

381-
return $Value
404+
if ($Encode) {
405+
return @(foreach ($v in $Value) {
406+
[System.Net.WebUtility]::HtmlEncode($v)
407+
})
408+
}
409+
else {
410+
return $Value
411+
}
382412
}
383413

384414
function Test-PodeWebRoute

‎src/Public/Elements.ps1

Lines changed: 70 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -107,15 +107,15 @@ function New-PodeWebTextbox
107107
ObjectType = 'Textbox'
108108
Parent = $ElementData
109109
Name = $Name
110-
DisplayName = (Protect-PodeWebValue -Value $DisplayName -Default $Name)
110+
DisplayName = (Protect-PodeWebValue -Value $DisplayName -Default $Name -Encode)
111111
ID = $Id
112112
Type = $Type
113113
Multiline = $Multiline.IsPresent
114114
Placeholder = $Placeholder
115115
Size = $Size
116116
Width = (ConvertTo-PodeWebSize -Value $Width -Default 'auto' -Type '%')
117117
Preformat = $Preformat.IsPresent
118-
HelpText = $HelpText
118+
HelpText = [System.Net.WebUtility]::HtmlEncode($HelpText)
119119
ReadOnly = $ReadOnly.IsPresent
120120
IsAutoComplete = ($null -ne $AutoComplete)
121121
Value = $Value
@@ -206,7 +206,7 @@ function New-PodeWebFileUpload
206206
ObjectType = 'FileUpload'
207207
Parent = $ElementData
208208
Name = $Name
209-
DisplayName = (Protect-PodeWebValue -Value $DisplayName -Default $Name)
209+
DisplayName = (Protect-PodeWebValue -Value $DisplayName -Default $Name -Encode)
210210
ID = $Id
211211
Accept = ($Accept -join ',')
212212
CssClasses = ($CssClass -join ' ')
@@ -419,10 +419,10 @@ function New-PodeWebCheckbox
419419
ObjectType = 'Checkbox'
420420
Parent = $ElementData
421421
Name = $Name
422-
DisplayName = (Protect-PodeWebValue -Value $DisplayName -Default $Name)
422+
DisplayName = (Protect-PodeWebValue -Value $DisplayName -Default $Name -Encode)
423423
ID = $Id
424424
Options = @($Options)
425-
DisplayOptions = @(Protect-PodeWebValues -Value $DisplayOptions -Default $Options -EqualCount)
425+
DisplayOptions = @(Protect-PodeWebValues -Value $DisplayOptions -Default $Options -EqualCount -Encode)
426426
Inline = $Inline.IsPresent
427427
AsSwitch = $AsSwitch.IsPresent
428428
Checked = $Checked.IsPresent
@@ -486,10 +486,10 @@ function New-PodeWebRadio
486486
ObjectType = 'Radio'
487487
Parent = $ElementData
488488
Name = $Name
489-
DisplayName = (Protect-PodeWebValue -Value $DisplayName -Default $Name)
489+
DisplayName = (Protect-PodeWebValue -Value $DisplayName -Default $Name -Encode)
490490
ID = $Id
491491
Options = @($Options)
492-
DisplayOptions = @(Protect-PodeWebValues -Value $DisplayOptions -Default $Options -EqualCount)
492+
DisplayOptions = @(Protect-PodeWebValues -Value $DisplayOptions -Default $Options -EqualCount -Encode)
493493
Inline = $Inline.IsPresent
494494
Disabled = $Disabled.IsPresent
495495
CssClasses = ($CssClass -join ' ')
@@ -568,10 +568,10 @@ function New-PodeWebSelect
568568
ObjectType = 'Select'
569569
Parent = $ElementData
570570
Name = $Name
571-
DisplayName = (Protect-PodeWebValue -Value $DisplayName -Default $Name)
571+
DisplayName = (Protect-PodeWebValue -Value $DisplayName -Default $Name -Encode)
572572
ID = $Id
573573
Options = @($Options)
574-
DisplayOptions = @(Protect-PodeWebValues -Value $DisplayOptions -Default $Options -EqualCount)
574+
DisplayOptions = @(Protect-PodeWebValues -Value $DisplayOptions -Default $Options -EqualCount -Encode)
575575
ScriptBlock = $ScriptBlock
576576
IsDynamic = ($null -ne $ScriptBlock)
577577
SelectedValue = $SelectedValue
@@ -680,7 +680,7 @@ function New-PodeWebRange
680680
ObjectType = 'Range'
681681
Parent = $ElementData
682682
Name = $Name
683-
DisplayName = (Protect-PodeWebValue -Value $DisplayName -Default $Name)
683+
DisplayName = (Protect-PodeWebValue -Value $DisplayName -Default $Name -Encode)
684684
ID = $Id
685685
Value = $Value
686686
Min = $Min
@@ -702,6 +702,10 @@ function New-PodeWebProgress
702702
[string]
703703
$Name,
704704

705+
[Parameter()]
706+
[string]
707+
$DisplayName,
708+
705709
[Parameter()]
706710
[string]
707711
$Id,
@@ -762,6 +766,7 @@ function New-PodeWebProgress
762766
ObjectType = 'Progress'
763767
Parent = $ElementData
764768
Name = $Name
769+
DisplayName = (Protect-PodeWebValue -Value $DisplayName -Default $Name -Encode)
765770
ID = $Id
766771
Value = $Value
767772
Min = $Min
@@ -1043,7 +1048,7 @@ function New-PodeWebLink
10431048
Parent = $ElementData
10441049
ID = $Id
10451050
Source = (Add-PodeWebAppPath -Url $Source)
1046-
Value = $Value
1051+
Value = [System.Net.WebUtility]::HtmlEncode($Value)
10471052
NewTab = $NewTab.IsPresent
10481053
CssClasses = ($CssClass -join ' ')
10491054
CssStyles = (ConvertTo-PodeWebStyles -Style $CssStyle)
@@ -1203,11 +1208,11 @@ function New-PodeWebCredential
12031208

12041209
[Parameter()]
12051210
[string]
1206-
$PlaceholderUsername,
1211+
$DisplayUsername,
12071212

12081213
[Parameter()]
12091214
[string]
1210-
$PlaceholderPassword,
1215+
$DisplayPassword,
12111216

12121217
[Parameter()]
12131218
[ValidateSet('Username', 'Password')]
@@ -1232,16 +1237,16 @@ function New-PodeWebCredential
12321237
ObjectType = 'Credential'
12331238
Parent = $ElementData
12341239
Name = $Name
1235-
DisplayName = (Protect-PodeWebValue -Value $DisplayName -Default $Name)
1240+
DisplayName = (Protect-PodeWebValue -Value $DisplayName -Default $Name -Encode)
12361241
ID = $Id
1237-
HelpText = $HelpText
1242+
HelpText = [System.Net.WebUtility]::HtmlEncode($HelpText)
12381243
ReadOnly = $ReadOnly.IsPresent
12391244
NoLabels = $NoLabels.IsPresent
12401245
CssClasses = ($CssClass -join ' ')
12411246
CssStyles = (ConvertTo-PodeWebStyles -Style $CssStyle)
12421247
Placeholders = @{
1243-
Username = (Protect-PodeWebValue -Value $PlaceholderUsername -Default 'Username')
1244-
Password = (Protect-PodeWebValue -Value $PlaceholderPassword -Default 'Password')
1248+
Username = (Protect-PodeWebValue -Value $DisplayUsername -Default 'Username' -Encode)
1249+
Password = (Protect-PodeWebValue -Value $DisplayPassword -Default 'Password' -Encode)
12451250
}
12461251
Type = @($Type)
12471252
Required = $Required.IsPresent
@@ -1276,6 +1281,14 @@ function New-PodeWebDateTime
12761281
[hashtable]
12771282
$CssStyle,
12781283

1284+
[Parameter()]
1285+
[string]
1286+
$DisplayDate,
1287+
1288+
[Parameter()]
1289+
[string]
1290+
$DisplayTime,
1291+
12791292
[Parameter()]
12801293
[ValidateSet('Date', 'Time')]
12811294
[ValidateNotNullOrEmpty()]
@@ -1299,13 +1312,17 @@ function New-PodeWebDateTime
12991312
ObjectType = 'DateTime'
13001313
Parent = $ElementData
13011314
Name = $Name
1302-
DisplayName = (Protect-PodeWebValue -Value $DisplayName -Default $Name)
1315+
DisplayName = (Protect-PodeWebValue -Value $DisplayName -Default $Name -Encode)
13031316
ID = $Id
1304-
HelpText = $HelpText
1317+
HelpText = [System.Net.WebUtility]::HtmlEncode($HelpText)
13051318
ReadOnly = $ReadOnly.IsPresent
13061319
NoLabels = $NoLabels.IsPresent
13071320
CssClasses = ($CssClass -join ' ')
13081321
CssStyles = (ConvertTo-PodeWebStyles -Style $CssStyle)
1322+
Placeholders = @{
1323+
Date = (Protect-PodeWebValue -Value $DisplayDate -Default 'Date' -Encode)
1324+
Time = (Protect-PodeWebValue -Value $DisplayTime -Default 'Time' -Encode)
1325+
}
13091326
Type = @($Type)
13101327
Required = $Required.IsPresent
13111328
}
@@ -1363,6 +1380,14 @@ function New-PodeWebMinMax
13631380
[hashtable]
13641381
$CssStyle,
13651382

1383+
[Parameter()]
1384+
[string]
1385+
$DisplayMin,
1386+
1387+
[Parameter()]
1388+
[string]
1389+
$DisplayMax,
1390+
13661391
[Parameter()]
13671392
[ValidateSet('Min', 'Max')]
13681393
[ValidateNotNullOrEmpty()]
@@ -1386,13 +1411,13 @@ function New-PodeWebMinMax
13861411
ObjectType = 'MinMax'
13871412
Parent = $ElementData
13881413
Name = $Name
1389-
DisplayName = (Protect-PodeWebValue -Value $DisplayName -Default $Name)
1414+
DisplayName = (Protect-PodeWebValue -Value $DisplayName -Default $Name -Encode)
13901415
ID = $Id
13911416
Values = @{
13921417
Min = $MinValue
13931418
Max = $MaxValue
13941419
}
1395-
HelpText = $HelpText
1420+
HelpText = [System.Net.WebUtility]::HtmlEncode($HelpText)
13961421
ReadOnly = $ReadOnly.IsPresent
13971422
NoLabels = $NoLabels.IsPresent
13981423
CssClasses = ($CssClass -join ' ')
@@ -1407,6 +1432,10 @@ function New-PodeWebMinMax
14071432
Text = $AppendText
14081433
Icon = $AppendIcon
14091434
}
1435+
Placeholders = @{
1436+
Min = (Protect-PodeWebValue -Value $DisplayMin -Default 'Minimum' -Encode)
1437+
Max = (Protect-PodeWebValue -Value $DisplayMax -Default 'Maximum' -Encode)
1438+
}
14101439
Type = @($Type)
14111440
Required = $Required.IsPresent
14121441
}
@@ -1438,6 +1467,10 @@ function New-PodeWebButton
14381467
[string]
14391468
$Name,
14401469

1470+
[Parameter()]
1471+
[string]
1472+
$DisplayName,
1473+
14411474
[Parameter()]
14421475
[string]
14431476
$Id,
@@ -1503,6 +1536,7 @@ function New-PodeWebButton
15031536
ObjectType = 'Button'
15041537
Parent = $ElementData
15051538
Name = $Name
1539+
DisplayName = (Protect-PodeWebValue -Value $DisplayName -Default $Name -Encode)
15061540
ID = $Id
15071541
DataValue = $DataValue
15081542
Icon = $Icon
@@ -1594,7 +1628,7 @@ function New-PodeWebAlert
15941628
ObjectType = 'Alert'
15951629
Parent = $ElementData
15961630
ID = $Id
1597-
Type = $Type
1631+
Type = [System.Net.WebUtility]::HtmlEncode($Type)
15981632
ClassType = $classType
15991633
IconType = $iconType
16001634
Value = [System.Net.WebUtility]::HtmlEncode($Value)
@@ -1793,8 +1827,8 @@ function New-PodeWebComment
17931827
Parent = $ElementData
17941828
ID = $Id
17951829
Icon = (Add-PodeWebAppPath -Url $Icon)
1796-
Username = $Username
1797-
Message = $Message
1830+
Username = [System.Net.WebUtility]::HtmlEncode($Username)
1831+
Message = [System.Net.WebUtility]::HtmlEncode($Message)
17981832
TimeStamp = $TimeStamp
17991833
CssClasses = ($CssClass -join ' ')
18001834
CssStyles = (ConvertTo-PodeWebStyles -Style $CssStyle)
@@ -2357,6 +2391,10 @@ function Add-PodeWebTableButton
23572391
[string]
23582392
$Name,
23592393

2394+
[Parameter()]
2395+
[string]
2396+
$DisplayName,
2397+
23602398
[Parameter()]
23612399
[string]
23622400
$Icon,
@@ -2411,6 +2449,7 @@ function Add-PodeWebTableButton
24112449

24122450
$Table.Buttons += @{
24132451
Name = $Name
2452+
DisplayName = (Protect-PodeWebValue -Value $DisplayName -Default $Name -Encode)
24142453
Icon = $Icon
24152454
IsDynamic = ($null -ne $ScriptBlock)
24162455
WithText = $WithText.IsPresent
@@ -2744,6 +2783,10 @@ function New-PodeWebTile
27442783
[string]
27452784
$Name,
27462785

2786+
[Parameter()]
2787+
[string]
2788+
$DisplayName,
2789+
27472790
[Parameter()]
27482791
[string]
27492792
$Id,
@@ -2822,6 +2865,7 @@ function New-PodeWebTile
28222865
ObjectType = 'Tile'
28232866
Parent = $ElementData
28242867
Name = $Name
2868+
DisplayName = (Protect-PodeWebValue -Value $DisplayName -Default $Name -Encode)
28252869
ID = $Id
28262870
Click = ($null -ne $ClickScriptBlock)
28272871
IsDynamic = ($null -ne $ScriptBlock)
@@ -3081,7 +3125,7 @@ function New-PodeWebAudio
30813125
Width = (ConvertTo-PodeWebSize -Value $Width -Default 20 -Type '%')
30823126
Sources = $Source
30833127
Tracks = $Track
3084-
NotSupportedText = (Protect-PodeWebValue -Value $NotSupportedText -Default 'Your browser does not support the audio element')
3128+
NotSupportedText = [System.Net.WebUtility]::HtmlEncode((Protect-PodeWebValue -Value $NotSupportedText -Default 'Your browser does not support the audio element'))
30853129
Muted = $Muted.IsPresent
30863130
AutoPlay = $AutoPlay.IsPresent
30873131
AutoBuffer = $AutoBuffer.IsPresent
@@ -3208,7 +3252,7 @@ function New-PodeWebVideo
32083252
Sources = $Source
32093253
Tracks = $Track
32103254
Thumbnail = $Thumbnail
3211-
NotSupportedText = (Protect-PodeWebValue -Value $NotSupportedText -Default 'Your browser does not support the video element')
3255+
NotSupportedText = [System.Net.WebUtility]::HtmlEncode((Protect-PodeWebValue -Value $NotSupportedText -Default 'Your browser does not support the video element'))
32123256
Muted = $Muted.IsPresent
32133257
AutoPlay = $AutoPlay.IsPresent
32143258
AutoBuffer = $AutoBuffer.IsPresent

0 commit comments

Comments
 (0)