mirror of
https://github.com/usetrmnl/byos_laravel.git
synced 2026-01-13 15:07:49 +00:00
add HTML rendering on config modal with tests
Models/Plugin will now sanitize "description" and "help text" before loading. This allows HTML from these fields to be rendered safely. Sanitization is done using Purify library for completeness (new dependency). A test suite of simple xss attacks is also added.
This commit is contained in:
jerremyng
Benjamin Nussbaum
parent
9019561bb3
commit
46e792bc6d
6 changed files with 470 additions and 158 deletions
|
|
@ -62,6 +62,11 @@ class Plugin extends Model
|
||||||
$model->current_image = null;
|
$model->current_image = null;
|
||||||
}
|
}
|
||||||
});
|
});
|
||||||
|
|
||||||
|
// Sanitize configuration template on save
|
||||||
|
static::saving(function ($model): void {
|
||||||
|
$model->sanitizeTemplate();
|
||||||
|
});
|
||||||
}
|
}
|
||||||
|
|
||||||
public function user()
|
public function user()
|
||||||
|
|
@ -69,6 +74,25 @@ class Plugin extends Model
|
||||||
return $this->belongsTo(User::class);
|
return $this->belongsTo(User::class);
|
||||||
}
|
}
|
||||||
|
|
||||||
|
// sanitize configuration template descriptions and help texts (since they allow HTML rendering)
|
||||||
|
protected function sanitizeTemplate(): void
|
||||||
|
{
|
||||||
|
$template = $this->configuration_template;
|
||||||
|
|
||||||
|
if (isset($template['custom_fields']) && is_array($template['custom_fields'])) {
|
||||||
|
foreach ($template['custom_fields'] as &$field) {
|
||||||
|
if (isset($field['description'])) {
|
||||||
|
$field['description'] = \Stevebauman\Purify\Facades\Purify::clean($field['description']);
|
||||||
|
}
|
||||||
|
if (isset($field['help_text'])) {
|
||||||
|
$field['help_text'] = \Stevebauman\Purify\Facades\Purify::clean($field['help_text']);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
$this->configuration_template = $template;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
public function hasMissingRequiredConfigurationFields(): bool
|
public function hasMissingRequiredConfigurationFields(): bool
|
||||||
{
|
{
|
||||||
if (! isset($this->configuration_template['custom_fields']) || empty($this->configuration_template['custom_fields'])) {
|
if (! isset($this->configuration_template['custom_fields']) || empty($this->configuration_template['custom_fields'])) {
|
||||||
|
|
|
||||||
|
|
@ -26,6 +26,7 @@
|
||||||
"livewire/volt": "^1.7",
|
"livewire/volt": "^1.7",
|
||||||
"om/icalparser": "^3.2",
|
"om/icalparser": "^3.2",
|
||||||
"spatie/browsershot": "^5.0",
|
"spatie/browsershot": "^5.0",
|
||||||
|
"stevebauman/purify": "^6.3",
|
||||||
"symfony/yaml": "^7.3",
|
"symfony/yaml": "^7.3",
|
||||||
"wnx/sidecar-browsershot": "^2.6"
|
"wnx/sidecar-browsershot": "^2.6"
|
||||||
},
|
},
|
||||||
|
|
|
||||||
129
composer.lock
generated
129
composer.lock
generated
|
|
@ -4,7 +4,7 @@
|
||||||
"Read more about it at https://getcomposer.org/doc/01-basic-usage.md#installing-dependencies",
|
"Read more about it at https://getcomposer.org/doc/01-basic-usage.md#installing-dependencies",
|
||||||
"This file is @generated automatically"
|
"This file is @generated automatically"
|
||||||
],
|
],
|
||||||
"content-hash": "4d958d48655a5ad9e3de6b4a9fb52b0a",
|
"content-hash": "25c2a1a4a2f2594adefe25ddb6a072fb",
|
||||||
"packages": [
|
"packages": [
|
||||||
{
|
{
|
||||||
"name": "aws/aws-crt-php",
|
"name": "aws/aws-crt-php",
|
||||||
|
|
@ -814,6 +814,67 @@
|
||||||
],
|
],
|
||||||
"time": "2025-03-06T22:45:56+00:00"
|
"time": "2025-03-06T22:45:56+00:00"
|
||||||
},
|
},
|
||||||
|
{
|
||||||
|
"name": "ezyang/htmlpurifier",
|
||||||
|
"version": "v4.19.0",
|
||||||
|
"source": {
|
||||||
|
"type": "git",
|
||||||
|
"url": "https://github.com/ezyang/htmlpurifier.git",
|
||||||
|
"reference": "b287d2a16aceffbf6e0295559b39662612b77fcf"
|
||||||
|
},
|
||||||
|
"dist": {
|
||||||
|
"type": "zip",
|
||||||
|
"url": "https://api.github.com/repos/ezyang/htmlpurifier/zipball/b287d2a16aceffbf6e0295559b39662612b77fcf",
|
||||||
|
"reference": "b287d2a16aceffbf6e0295559b39662612b77fcf",
|
||||||
|
"shasum": ""
|
||||||
|
},
|
||||||
|
"require": {
|
||||||
|
"php": "~5.6.0 || ~7.0.0 || ~7.1.0 || ~7.2.0 || ~7.3.0 || ~7.4.0 || ~8.0.0 || ~8.1.0 || ~8.2.0 || ~8.3.0 || ~8.4.0 || ~8.5.0"
|
||||||
|
},
|
||||||
|
"require-dev": {
|
||||||
|
"cerdic/css-tidy": "^1.7 || ^2.0",
|
||||||
|
"simpletest/simpletest": "dev-master"
|
||||||
|
},
|
||||||
|
"suggest": {
|
||||||
|
"cerdic/css-tidy": "If you want to use the filter 'Filter.ExtractStyleBlocks'.",
|
||||||
|
"ext-bcmath": "Used for unit conversion and imagecrash protection",
|
||||||
|
"ext-iconv": "Converts text to and from non-UTF-8 encodings",
|
||||||
|
"ext-tidy": "Used for pretty-printing HTML"
|
||||||
|
},
|
||||||
|
"type": "library",
|
||||||
|
"autoload": {
|
||||||
|
"files": [
|
||||||
|
"library/HTMLPurifier.composer.php"
|
||||||
|
],
|
||||||
|
"psr-0": {
|
||||||
|
"HTMLPurifier": "library/"
|
||||||
|
},
|
||||||
|
"exclude-from-classmap": [
|
||||||
|
"/library/HTMLPurifier/Language/"
|
||||||
|
]
|
||||||
|
},
|
||||||
|
"notification-url": "https://packagist.org/downloads/",
|
||||||
|
"license": [
|
||||||
|
"LGPL-2.1-or-later"
|
||||||
|
],
|
||||||
|
"authors": [
|
||||||
|
{
|
||||||
|
"name": "Edward Z. Yang",
|
||||||
|
"email": "admin@htmlpurifier.org",
|
||||||
|
"homepage": "http://ezyang.com"
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"description": "Standards compliant HTML filter written in PHP",
|
||||||
|
"homepage": "http://htmlpurifier.org/",
|
||||||
|
"keywords": [
|
||||||
|
"html"
|
||||||
|
],
|
||||||
|
"support": {
|
||||||
|
"issues": "https://github.com/ezyang/htmlpurifier/issues",
|
||||||
|
"source": "https://github.com/ezyang/htmlpurifier/tree/v4.19.0"
|
||||||
|
},
|
||||||
|
"time": "2025-10-17T16:34:55+00:00"
|
||||||
|
},
|
||||||
{
|
{
|
||||||
"name": "firebase/php-jwt",
|
"name": "firebase/php-jwt",
|
||||||
"version": "v6.11.1",
|
"version": "v6.11.1",
|
||||||
|
|
@ -4947,6 +5008,72 @@
|
||||||
],
|
],
|
||||||
"time": "2025-01-13T13:04:43+00:00"
|
"time": "2025-01-13T13:04:43+00:00"
|
||||||
},
|
},
|
||||||
|
{
|
||||||
|
"name": "stevebauman/purify",
|
||||||
|
"version": "v6.3.1",
|
||||||
|
"source": {
|
||||||
|
"type": "git",
|
||||||
|
"url": "https://github.com/stevebauman/purify.git",
|
||||||
|
"reference": "3acb5e77904f420ce8aad8fa1c7f394e82daa500"
|
||||||
|
},
|
||||||
|
"dist": {
|
||||||
|
"type": "zip",
|
||||||
|
"url": "https://api.github.com/repos/stevebauman/purify/zipball/3acb5e77904f420ce8aad8fa1c7f394e82daa500",
|
||||||
|
"reference": "3acb5e77904f420ce8aad8fa1c7f394e82daa500",
|
||||||
|
"shasum": ""
|
||||||
|
},
|
||||||
|
"require": {
|
||||||
|
"ezyang/htmlpurifier": "^4.17",
|
||||||
|
"illuminate/contracts": "^7.0|^8.0|^9.0|^10.0|^11.0|^12.0",
|
||||||
|
"illuminate/support": "^7.0|^8.0|^9.0|^10.0|^11.0|^12.0",
|
||||||
|
"php": ">=7.4"
|
||||||
|
},
|
||||||
|
"require-dev": {
|
||||||
|
"orchestra/testbench": "^5.0|^6.0|^7.0|^8.0|^9.0|^10.0",
|
||||||
|
"phpunit/phpunit": "^8.0|^9.0|^10.0|^11.5.3"
|
||||||
|
},
|
||||||
|
"type": "library",
|
||||||
|
"extra": {
|
||||||
|
"laravel": {
|
||||||
|
"aliases": {
|
||||||
|
"Purify": "Stevebauman\\Purify\\Facades\\Purify"
|
||||||
|
},
|
||||||
|
"providers": [
|
||||||
|
"Stevebauman\\Purify\\PurifyServiceProvider"
|
||||||
|
]
|
||||||
|
}
|
||||||
|
},
|
||||||
|
"autoload": {
|
||||||
|
"psr-4": {
|
||||||
|
"Stevebauman\\Purify\\": "src/"
|
||||||
|
}
|
||||||
|
},
|
||||||
|
"notification-url": "https://packagist.org/downloads/",
|
||||||
|
"license": [
|
||||||
|
"MIT"
|
||||||
|
],
|
||||||
|
"authors": [
|
||||||
|
{
|
||||||
|
"name": "Steve Bauman",
|
||||||
|
"email": "steven_bauman@outlook.com"
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"description": "An HTML Purifier / Sanitizer for Laravel",
|
||||||
|
"keywords": [
|
||||||
|
"Purifier",
|
||||||
|
"clean",
|
||||||
|
"cleaner",
|
||||||
|
"html",
|
||||||
|
"laravel",
|
||||||
|
"purification",
|
||||||
|
"purify"
|
||||||
|
],
|
||||||
|
"support": {
|
||||||
|
"issues": "https://github.com/stevebauman/purify/issues",
|
||||||
|
"source": "https://github.com/stevebauman/purify/tree/v6.3.1"
|
||||||
|
},
|
||||||
|
"time": "2025-05-21T16:53:09+00:00"
|
||||||
|
},
|
||||||
{
|
{
|
||||||
"name": "symfony/clock",
|
"name": "symfony/clock",
|
||||||
"version": "v8.0.0",
|
"version": "v8.0.0",
|
||||||
|
|
|
||||||
|
|
@ -59,6 +59,10 @@
|
||||||
@apply !mb-0 !leading-tight;
|
@apply !mb-0 !leading-tight;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
[data-flux-description] a {
|
||||||
|
@apply text-accent underline hover:opacity-80;
|
||||||
|
}
|
||||||
|
|
||||||
input:focus[data-flux-control],
|
input:focus[data-flux-control],
|
||||||
textarea:focus[data-flux-control],
|
textarea:focus[data-flux-control],
|
||||||
select:focus[data-flux-control] {
|
select:focus[data-flux-control] {
|
||||||
|
|
|
||||||
|
|
@ -639,6 +639,13 @@ HTML;
|
||||||
@php
|
@php
|
||||||
$fieldKey = $field['keyname'] ?? $field['key'] ?? $field['name'];
|
$fieldKey = $field['keyname'] ?? $field['key'] ?? $field['name'];
|
||||||
$rawValue = $configuration[$fieldKey] ?? ($field['default'] ?? '');
|
$rawValue = $configuration[$fieldKey] ?? ($field['default'] ?? '');
|
||||||
|
# These are sanitized at PluginImportService when imported, safe to render HTML
|
||||||
|
$safeDescription = $field['description'] ?? '';
|
||||||
|
$safeHelp = $field['help_text'] ?? '';
|
||||||
|
|
||||||
|
//Important: Sanitize with Purify to prevent XSS attacks
|
||||||
|
// $safeDescription = Stevebauman\Purify\Facades\Purify::clean($field['description'] ?? '');
|
||||||
|
// $safeHelp = Stevebauman\Purify\Facades\Purify::clean($field['help_text'] ?? '');
|
||||||
|
|
||||||
// For code fields, if the value is an array, JSON encode it
|
// For code fields, if the value is an array, JSON encode it
|
||||||
if ($field['field_type'] === 'code' && is_array($rawValue)) {
|
if ($field['field_type'] === 'code' && is_array($rawValue)) {
|
||||||
|
|
@ -657,176 +664,211 @@ HTML;
|
||||||
@endif
|
@endif
|
||||||
|
|
||||||
@if($field['field_type'] === 'string' || $field['field_type'] === 'url')
|
@if($field['field_type'] === 'string' || $field['field_type'] === 'url')
|
||||||
<flux:input
|
<flux:field>
|
||||||
label="{{ $field['name'] }}"
|
<flux:label>{{ $field['name'] }}</flux:label>
|
||||||
description="{{ $field['description'] ?? '' }}"
|
<flux:description>{!! $safeDescription !!}</flux:description>
|
||||||
descriptionTrailing="{{ $field['help_text'] ?? '' }}"
|
<flux:input
|
||||||
wire:model="configuration.{{ $fieldKey }}"
|
wire:model="configuration.{{ $fieldKey }}"
|
||||||
value="{{ $currentValue }}"
|
value="{{ $currentValue }}"
|
||||||
/>
|
/>
|
||||||
|
<flux:description>{!! $safeHelp !!}</flux:description>
|
||||||
|
</flux:field>
|
||||||
|
|
||||||
@elseif($field['field_type'] === 'text')
|
@elseif($field['field_type'] === 'text')
|
||||||
<flux:textarea
|
<flux:field>
|
||||||
label="{{ $field['name'] }}"
|
<flux:label>{{ $field['name'] }}</flux:label>
|
||||||
description="{{ $field['description'] ?? '' }}"
|
<flux:description>{!! $safeDescription !!}</flux:description>
|
||||||
descriptionTrailing="{{ $field['help_text'] ?? '' }}"
|
<flux:textarea
|
||||||
wire:model="configuration.{{ $fieldKey }}"
|
wire:model="configuration.{{ $fieldKey }}"
|
||||||
value="{{ $currentValue }}"
|
value="{{ $currentValue }}"
|
||||||
/>
|
/>
|
||||||
|
<flux:description>{!! $safeHelp !!}</flux:description>
|
||||||
|
</flux:field>
|
||||||
|
|
||||||
@elseif($field['field_type'] === 'code')
|
@elseif($field['field_type'] === 'code')
|
||||||
<flux:textarea
|
<flux:field>
|
||||||
label="{{ $field['name'] }}"
|
<flux:label>{{ $field['name'] }}</flux:label>
|
||||||
description="{{ $field['description'] ?? '' }}"
|
<flux:description>{!! $safeDescription !!}</flux:description>
|
||||||
descriptionTrailing="{{ $field['help_text'] ?? '' }}"
|
<flux:textarea
|
||||||
rows="{{ $field['rows'] ?? 3 }}"
|
rows="{{ $field['rows'] ?? 3 }}"
|
||||||
placeholder="{{ $field['placeholder'] ?? null }}"
|
placeholder="{{ $field['placeholder'] ?? null }}"
|
||||||
wire:model="configuration.{{ $fieldKey }}"
|
wire:model="configuration.{{ $fieldKey }}"
|
||||||
value="{{ $currentValue }}"
|
value="{{ $currentValue }}"
|
||||||
class="font-mono"
|
class="font-mono"
|
||||||
/>
|
/>
|
||||||
|
<flux:description>{!! $safeHelp !!}</flux:description>
|
||||||
|
</flux:field>
|
||||||
|
|
||||||
@elseif($field['field_type'] === 'password')
|
@elseif($field['field_type'] === 'password')
|
||||||
<flux:input
|
<flux:field>
|
||||||
type="password"
|
<flux:label>{{ $field['name'] }}</flux:label>
|
||||||
label="{{ $field['name'] }}"
|
<flux:description>{!! $safeDescription !!}</flux:description>
|
||||||
description="{{ $field['description'] ?? '' }}"
|
<flux:input
|
||||||
descriptionTrailing="{{ $field['help_text'] ?? '' }}"
|
type="password"
|
||||||
wire:model="configuration.{{ $fieldKey }}"
|
wire:model="configuration.{{ $fieldKey }}"
|
||||||
value="{{ $currentValue }}"
|
value="{{ $currentValue }}"
|
||||||
viewable
|
viewable
|
||||||
/>
|
/>
|
||||||
|
<flux:description>{!! $safeHelp !!}</flux:description>
|
||||||
|
</flux:field>
|
||||||
|
|
||||||
@elseif($field['field_type'] === 'copyable')
|
@elseif($field['field_type'] === 'copyable')
|
||||||
<flux:input
|
<flux:field>
|
||||||
label="{{ $field['name'] }}"
|
<flux:label>{{ $field['name'] }}</flux:label>
|
||||||
description="{{ $field['description'] ?? '' }}"
|
<flux:description>{!! $safeDescription !!}</flux:description>
|
||||||
descriptionTrailing="{{ $field['help_text'] ?? '' }}"
|
<flux:input
|
||||||
value="{{ $field['value'] }}"
|
value="{{ $field['value'] }}"
|
||||||
copyable
|
copyable
|
||||||
/>
|
/>
|
||||||
|
<flux:description>{!! $safeHelp !!}</flux:description>
|
||||||
|
</flux:field>
|
||||||
|
|
||||||
@elseif($field['field_type'] === 'time_zone')
|
@elseif($field['field_type'] === 'time_zone')
|
||||||
<flux:select
|
<flux:field>
|
||||||
label="{{ $field['name'] }}"
|
<flux:label>{{ $field['name'] }}</flux:label>
|
||||||
wire:model="configuration.{{ $fieldKey }}"
|
<flux:description>{!! $safeDescription !!}</flux:description>
|
||||||
description="{{ $field['description'] ?? '' }}"
|
<flux:select
|
||||||
descriptionTrailing="{{ $field['help_text'] ?? '' }}"
|
wire:model="configuration.{{ $fieldKey }}"
|
||||||
>
|
value="{{ $field['value'] }}"
|
||||||
<option value="">Select timezone...</option>
|
>
|
||||||
@foreach(timezone_identifiers_list() as $timezone)
|
<option value="">Select timezone...</option>
|
||||||
<option value="{{ $timezone }}" {{ $currentValue === $timezone ? 'selected' : '' }}>{{ $timezone }}</option>
|
@foreach(timezone_identifiers_list() as $timezone)
|
||||||
@endforeach
|
<option value="{{ $timezone }}" {{ $currentValue === $timezone ? 'selected' : '' }}>{{ $timezone }}</option>
|
||||||
</flux:select>
|
@endforeach
|
||||||
|
</flux:select>
|
||||||
|
<flux:description>{!! $safeHelp !!}</flux:description>
|
||||||
|
</flux:field>
|
||||||
|
|
||||||
@elseif($field['field_type'] === 'number')
|
@elseif($field['field_type'] === 'number')
|
||||||
<flux:input
|
<flux:field>
|
||||||
type="number"
|
<flux:label>{{ $field['name'] }}</flux:label>
|
||||||
label="{{ $field['name'] }}"
|
<flux:description>{!! $safeDescription !!}</flux:description>
|
||||||
description="{{ $field['description'] ?? $field['name'] }}"
|
<flux:input
|
||||||
descriptionTrailing="{{ $field['help_text'] ?? '' }}"
|
type="number"
|
||||||
wire:model="configuration.{{ $fieldKey }}"
|
wire:model="configuration.{{ $fieldKey }}"
|
||||||
value="{{ $currentValue }}"
|
value="{{ $currentValue }}"
|
||||||
/>
|
/>
|
||||||
|
<flux:description>{!! $safeHelp !!}</flux:description>
|
||||||
|
</flux:field>
|
||||||
|
|
||||||
@elseif($field['field_type'] === 'boolean')
|
@elseif($field['field_type'] === 'boolean')
|
||||||
<flux:checkbox
|
<flux:field>
|
||||||
label="{{ $field['name'] }}"
|
<flux:label>{{ $field['name'] }}</flux:label>
|
||||||
description="{{ $field['description'] ?? $field['name'] }}"
|
<flux:description>{!! $safeDescription !!}</flux:description>
|
||||||
descriptionTrailing="{{ $field['help_text'] ?? '' }}"
|
<flux:checkbox
|
||||||
wire:model="configuration.{{ $fieldKey }}"
|
wire:model="configuration.{{ $fieldKey }}"
|
||||||
:checked="$currentValue"
|
:checked="$currentValue"
|
||||||
/>
|
/>
|
||||||
|
<flux:description>{!! $safeHelp !!}</flux:description>
|
||||||
|
</flux:field>
|
||||||
|
|
||||||
@elseif($field['field_type'] === 'date')
|
@elseif($field['field_type'] === 'date')
|
||||||
<flux:input
|
<flux:field>
|
||||||
type="date"
|
<flux:label>{{ $field['name'] }}</flux:label>
|
||||||
label="{{ $field['name'] }}"
|
<flux:description>{!! $safeDescription !!}</flux:description>
|
||||||
description="{{ $field['description'] ?? $field['name'] }}"
|
<flux:input
|
||||||
descriptionTrailing="{{ $field['help_text'] ?? '' }}"
|
type="date"
|
||||||
wire:model="configuration.{{ $fieldKey }}"
|
wire:model="configuration.{{ $fieldKey }}"
|
||||||
value="{{ $currentValue }}"
|
value="{{ $currentValue }}"
|
||||||
/>
|
/>
|
||||||
|
<flux:description>{!! $safeHelp !!}</flux:description>
|
||||||
|
</flux:field>
|
||||||
|
|
||||||
@elseif($field['field_type'] === 'time')
|
@elseif($field['field_type'] === 'time')
|
||||||
<flux:input
|
<flux:field>
|
||||||
type="time"
|
<flux:label>{{ $field['name'] }}</flux:label>
|
||||||
label="{{ $field['name'] }}"
|
<flux:description>{!! $safeDescription !!}</flux:description>
|
||||||
description="{{ $field['description'] ?? $field['name'] }}"
|
<flux:input
|
||||||
descriptionTrailing="{{ $field['help_text'] ?? '' }}"
|
type="time"
|
||||||
wire:model="configuration.{{ $fieldKey }}"
|
wire:model="configuration.{{ $fieldKey }}"
|
||||||
value="{{ $currentValue }}"
|
value="{{ $currentValue }}"
|
||||||
/>
|
/>
|
||||||
|
<flux:description>{!! $safeHelp !!}</flux:description>
|
||||||
|
</flux:field>
|
||||||
|
|
||||||
@elseif($field['field_type'] === 'select')
|
@elseif($field['field_type'] === 'select')
|
||||||
@if(isset($field['multiple']) && $field['multiple'] === true)
|
@if(isset($field['multiple']) && $field['multiple'] === true)
|
||||||
<flux:checkbox.group
|
<flux:field>
|
||||||
label="{{ $field['name'] }}"
|
<flux:label>{{ $field['name'] }}</flux:label>
|
||||||
wire:model="configuration.{{ $fieldKey }}"
|
<flux:description>{!! $safeDescription !!}</flux:description>
|
||||||
description="{{ $field['description'] ?? '' }}"
|
<flux:checkbox.group wire:model="configuration.{{ $fieldKey }}">
|
||||||
descriptionTrailing="{{ $field['help_text'] ?? '' }}"
|
@if(isset($field['options']) && is_array($field['options']))
|
||||||
>
|
@foreach($field['options'] as $option)
|
||||||
@if(isset($field['options']) && is_array($field['options']))
|
@if(is_array($option))
|
||||||
@foreach($field['options'] as $option)
|
@foreach($option as $label => $value)
|
||||||
@if(is_array($option))
|
<flux:checkbox label="{{ $label }}" value="{{ $value }}"/>
|
||||||
@foreach($option as $label => $value)
|
@endforeach
|
||||||
<flux:checkbox label="{{ $label }}" value="{{ $value }}"/>
|
@else
|
||||||
@endforeach
|
@php
|
||||||
@else
|
$key = mb_strtolower(str_replace(' ', '_', $option));
|
||||||
@php
|
@endphp
|
||||||
$key = mb_strtolower(str_replace(' ', '_', $option));
|
<flux:checkbox label="{{ $option }}" value="{{ $key }}"/>
|
||||||
@endphp
|
@endif
|
||||||
<flux:checkbox label="{{ $option }}" value="{{ $key }}"/>
|
@endforeach
|
||||||
@endif
|
@endif
|
||||||
@endforeach
|
</flux:checkbox.group>
|
||||||
@endif
|
<flux:description>{!! $safeHelp !!}</flux:description>
|
||||||
</flux:checkbox.group>
|
</flux:field>
|
||||||
@else
|
@else
|
||||||
|
<flux:field>
|
||||||
|
<flux:label>{{ $field['name'] }}</flux:label>
|
||||||
|
<flux:description>{!! $safeDescription !!}</flux:description>
|
||||||
|
<flux:select wire:model="configuration.{{ $fieldKey }}">
|
||||||
|
<option value="">Select {{ $field['name'] }}...</option>
|
||||||
|
@if(isset($field['options']) && is_array($field['options']))
|
||||||
|
@foreach($field['options'] as $option)
|
||||||
|
@if(is_array($option))
|
||||||
|
@foreach($option as $label => $value)
|
||||||
|
<option value="{{ $value }}" {{ $currentValue === $value ? 'selected' : '' }}>{{ $label }}</option>
|
||||||
|
@endforeach
|
||||||
|
@else
|
||||||
|
@php
|
||||||
|
$key = mb_strtolower(str_replace(' ', '_', $option));
|
||||||
|
@endphp
|
||||||
|
<option value="{{ $key }}" {{ $currentValue === $key ? 'selected' : '' }}>{{ $option }}</option>
|
||||||
|
@endif
|
||||||
|
@endforeach
|
||||||
|
@endif
|
||||||
|
</flux:select>
|
||||||
|
<flux:description>{!! $safeHelp !!}</flux:description>
|
||||||
|
</flux:field>
|
||||||
|
@endif
|
||||||
|
|
||||||
|
@elseif($field['field_type'] === 'xhrSelect')
|
||||||
|
<flux:field>
|
||||||
|
<flux:label>{{ $field['name'] }}</flux:label>
|
||||||
|
<flux:description>{!! $safeDescription !!}</flux:description>
|
||||||
<flux:select
|
<flux:select
|
||||||
label="{{ $field['name'] }}"
|
|
||||||
wire:model="configuration.{{ $fieldKey }}"
|
wire:model="configuration.{{ $fieldKey }}"
|
||||||
description="{{ $field['description'] ?? '' }}"
|
wire:init="loadXhrSelectOptions('{{ $fieldKey }}', '{{ $field['endpoint'] }}')"
|
||||||
descriptionTrailing="{{ $field['help_text'] ?? '' }}"
|
|
||||||
>
|
>
|
||||||
<option value="">Select {{ $field['name'] }}...</option>
|
<option value="">Select {{ $field['name'] }}...</option>
|
||||||
@if(isset($field['options']) && is_array($field['options']))
|
@if(isset($xhrSelectOptions[$fieldKey]) && is_array($xhrSelectOptions[$fieldKey]))
|
||||||
@foreach($field['options'] as $option)
|
@foreach($xhrSelectOptions[$fieldKey] as $option)
|
||||||
@if(is_array($option))
|
@if(is_array($option))
|
||||||
@foreach($option as $label => $value)
|
@if(isset($option['id']) && isset($option['name']))
|
||||||
<option value="{{ $value }}" {{ $currentValue === $value ? 'selected' : '' }}>{{ $label }}</option>
|
{{-- xhrSelectSearch format: { 'id' => 'db-456', 'name' => 'Team Goals' } --}}
|
||||||
@endforeach
|
<option value="{{ $option['id'] }}" {{ $currentValue === (string)$option['id'] ? 'selected' : '' }}>{{ $option['name'] }}</option>
|
||||||
|
@else
|
||||||
|
{{-- xhrSelect format: { 'Braves' => 123 } --}}
|
||||||
|
@foreach($option as $label => $value)
|
||||||
|
<option value="{{ $value }}" {{ $currentValue === (string)$value ? 'selected' : '' }}>{{ $label }}</option>
|
||||||
|
@endforeach
|
||||||
|
@endif
|
||||||
@else
|
@else
|
||||||
@php
|
<option value="{{ $option }}" {{ $currentValue === (string)$option ? 'selected' : '' }}>{{ $option }}</option>
|
||||||
$key = mb_strtolower(str_replace(' ', '_', $option));
|
|
||||||
@endphp
|
|
||||||
<option value="{{ $key }}" {{ $currentValue === $key ? 'selected' : '' }}>{{ $option }}</option>
|
|
||||||
@endif
|
@endif
|
||||||
@endforeach
|
@endforeach
|
||||||
@endif
|
@endif
|
||||||
</flux:select>
|
</flux:select>
|
||||||
@endif
|
<flux:description>{!! $safeHelp !!}</flux:description>
|
||||||
@elseif($field['field_type'] === 'xhrSelect')
|
</flux:field>
|
||||||
<flux:select
|
|
||||||
label="{{ $field['name'] }}"
|
|
||||||
wire:model="configuration.{{ $fieldKey }}"
|
|
||||||
description="{{ $field['description'] ?? '' }}"
|
|
||||||
descriptionTrailing="{{ $field['help_text'] ?? '' }}"
|
|
||||||
wire:init="loadXhrSelectOptions('{{ $fieldKey }}', '{{ $field['endpoint'] }}')"
|
|
||||||
>
|
|
||||||
<option value="">Select {{ $field['name'] }}...</option>
|
|
||||||
@if(isset($xhrSelectOptions[$fieldKey]) && is_array($xhrSelectOptions[$fieldKey]))
|
|
||||||
@foreach($xhrSelectOptions[$fieldKey] as $option)
|
|
||||||
@if(is_array($option))
|
|
||||||
@if(isset($option['id']) && isset($option['name']))
|
|
||||||
{{-- xhrSelectSearch format: { 'id' => 'db-456', 'name' => 'Team Goals' } --}}
|
|
||||||
<option value="{{ $option['id'] }}" {{ $currentValue === (string)$option['id'] ? 'selected' : '' }}>{{ $option['name'] }}</option>
|
|
||||||
@else
|
|
||||||
{{-- xhrSelect format: { 'Braves' => 123 } --}}
|
|
||||||
@foreach($option as $label => $value)
|
|
||||||
<option value="{{ $value }}" {{ $currentValue === (string)$value ? 'selected' : '' }}>{{ $label }}</option>
|
|
||||||
@endforeach
|
|
||||||
@endif
|
|
||||||
@else
|
|
||||||
<option value="{{ $option }}" {{ $currentValue === (string)$option ? 'selected' : '' }}>{{ $option }}</option>
|
|
||||||
@endif
|
|
||||||
@endforeach
|
|
||||||
@endif
|
|
||||||
</flux:select>
|
|
||||||
@elseif($field['field_type'] === 'xhrSelectSearch')
|
@elseif($field['field_type'] === 'xhrSelectSearch')
|
||||||
<div class="space-y-2">
|
<div class="space-y-2">
|
||||||
|
|
||||||
<flux:label>{{ $field['name'] }}</flux:label>
|
<flux:label>{{ $field['name'] }}</flux:label>
|
||||||
<flux:description>{{ $field['description'] ?? '' }}</flux:description>
|
<flux:description>{!! $safeDescription !!}</flux:description>
|
||||||
<flux:input.group>
|
<flux:input.group>
|
||||||
<flux:input
|
<flux:input
|
||||||
wire:model="searchQueries.{{ $fieldKey }}"
|
wire:model="searchQueries.{{ $fieldKey }}"
|
||||||
|
|
@ -836,7 +878,7 @@ HTML;
|
||||||
wire:click="searchXhrSelect('{{ $fieldKey }}', '{{ $field['endpoint'] }}')"
|
wire:click="searchXhrSelect('{{ $fieldKey }}', '{{ $field['endpoint'] }}')"
|
||||||
icon="magnifying-glass"/>
|
icon="magnifying-glass"/>
|
||||||
</flux:input.group>
|
</flux:input.group>
|
||||||
<flux:description>{{ $field['help_text'] ?? '' }}</flux:description>
|
<flux:description>{!! $safeHelp !!}</flux:description>
|
||||||
@if((isset($xhrSelectOptions[$fieldKey]) && is_array($xhrSelectOptions[$fieldKey]) && count($xhrSelectOptions[$fieldKey]) > 0) || !empty($currentValue))
|
@if((isset($xhrSelectOptions[$fieldKey]) && is_array($xhrSelectOptions[$fieldKey]) && count($xhrSelectOptions[$fieldKey]) > 0) || !empty($currentValue))
|
||||||
<flux:select
|
<flux:select
|
||||||
wire:model="configuration.{{ $fieldKey }}"
|
wire:model="configuration.{{ $fieldKey }}"
|
||||||
|
|
@ -867,14 +909,16 @@ HTML;
|
||||||
@endif
|
@endif
|
||||||
</div>
|
</div>
|
||||||
@elseif($field['field_type'] === 'multi_string')
|
@elseif($field['field_type'] === 'multi_string')
|
||||||
<flux:input
|
<flux:field>
|
||||||
label="{{ $field['name'] }}"
|
<flux:label>{{ $field['name'] }}</flux:label>
|
||||||
description="{{ $field['description'] ?? '' }}"
|
<flux:description>{!! $safeDescription !!}</flux:description>
|
||||||
descriptionTrailing="{{ $field['help_text'] ?? 'Enter multiple values separated by commas' }}"
|
<flux:input
|
||||||
wire:model="configuration.{{ $fieldKey }}"
|
wire:model="configuration.{{ $fieldKey }}"
|
||||||
value="{{ $currentValue }}"
|
value="{{ $currentValue }}"
|
||||||
placeholder="{{ $field['placeholder'] ?? 'value1,value2' }}"
|
placeholder="{{ $field['placeholder'] ?? 'value1,value2' }}"
|
||||||
/>
|
/>
|
||||||
|
<flux:description>{!! $safeHelp !!}</flux:description>
|
||||||
|
</flux:field>
|
||||||
@else
|
@else
|
||||||
<flux:callout variant="warning">Field type "{{ $field['field_type'] }}" not yet supported</flux:callout>
|
<flux:callout variant="warning">Field type "{{ $field['field_type'] }}" not yet supported</flux:callout>
|
||||||
@endif
|
@endif
|
||||||
|
|
|
||||||
|
|
@ -4,8 +4,12 @@ use App\Models\Plugin;
|
||||||
use App\Models\User;
|
use App\Models\User;
|
||||||
use Carbon\Carbon;
|
use Carbon\Carbon;
|
||||||
use Illuminate\Support\Facades\Http;
|
use Illuminate\Support\Facades\Http;
|
||||||
|
use Livewire\Volt\Volt;
|
||||||
|
use Illuminate\Foundation\Testing\RefreshDatabase;
|
||||||
|
|
||||||
uses(Illuminate\Foundation\Testing\RefreshDatabase::class);
|
use Tests\TestCase;
|
||||||
|
|
||||||
|
uses(TestCase::class,RefreshDatabase::class);
|
||||||
|
|
||||||
test('plugin has required attributes', function (): void {
|
test('plugin has required attributes', function (): void {
|
||||||
$plugin = Plugin::factory()->create([
|
$plugin = Plugin::factory()->create([
|
||||||
|
|
@ -679,3 +683,111 @@ test('plugin render includes utc_offset and time_zone_iana in trmnl.user context
|
||||||
->toContain('America/Chicago')
|
->toContain('America/Chicago')
|
||||||
->and($rendered)->toMatch('/\|-?\d+/'); // Should contain a pipe followed by a number (offset in seconds)
|
->and($rendered)->toMatch('/\|-?\d+/'); // Should contain a pipe followed by a number (offset in seconds)
|
||||||
});
|
});
|
||||||
|
|
||||||
|
|
||||||
|
/**
|
||||||
|
* Plugin security: XSS Payload Dataset
|
||||||
|
* [Input, Expected to See, Dangerous parts that must be Missing]
|
||||||
|
*/
|
||||||
|
dataset('xss_vectors', [
|
||||||
|
'standard_script' => [
|
||||||
|
'Safe <script>alert(1)</script>',
|
||||||
|
'Safe',
|
||||||
|
['<script>', 'alert(1)']
|
||||||
|
],
|
||||||
|
'attribute_event_handlers' => [
|
||||||
|
'<a href="https://trmnl.com" onmouseover="alert(1)" onclick="confirm()">Link</a>',
|
||||||
|
'<a href="https://trmnl.com">Link</a>',
|
||||||
|
['onmouseover', 'onclick', 'confirm()']
|
||||||
|
],
|
||||||
|
'javascript_protocol' => [
|
||||||
|
'<a href="javascript:alert(1)">Click Me</a>',
|
||||||
|
'<a>Click Me</a>',
|
||||||
|
['javascript:']
|
||||||
|
],
|
||||||
|
'broken_tags_layout_break' => [
|
||||||
|
'<b>Unclosed tag <script>alert(1)</script>',
|
||||||
|
'<b>Unclosed tag',
|
||||||
|
['<script>']
|
||||||
|
],
|
||||||
|
'iframe_injection' => [
|
||||||
|
'Watch <iframe src="https://malicious.com"></iframe>',
|
||||||
|
'Watch',
|
||||||
|
['<iframe>', 'https://malicious.com']
|
||||||
|
],
|
||||||
|
'encoded_entities' => [
|
||||||
|
'<a href="javascript:alert(1)">Link</a>',
|
||||||
|
'<a>Link</a>',
|
||||||
|
['javascript']
|
||||||
|
],
|
||||||
|
'img_onerror_fallback' => [
|
||||||
|
'Photo <img src=x onerror=alert(1)>',
|
||||||
|
'Photo',
|
||||||
|
['onerror', 'alert(1)']
|
||||||
|
],
|
||||||
|
]);
|
||||||
|
|
||||||
|
test('plugin config descriptions are sanitized', function (string $input, string $expectedSee, array $forbidden) : void {
|
||||||
|
$user = User::factory()->create();
|
||||||
|
|
||||||
|
// This triggers the static::saving hook in the Plugin model
|
||||||
|
$plugin = Plugin::create([
|
||||||
|
'user_id' => $user->id,
|
||||||
|
'name' => 'Security Test Plugin',
|
||||||
|
'data_stale_minutes' => 15,
|
||||||
|
'data_strategy' => 'static',
|
||||||
|
'polling_verb' => 'get',
|
||||||
|
'configuration_template' => [
|
||||||
|
'custom_fields' => [
|
||||||
|
[
|
||||||
|
'keyname' => 'test_field',
|
||||||
|
'field_type' => 'string',
|
||||||
|
'name' => 'Secure Field',
|
||||||
|
'description' => $input,
|
||||||
|
],
|
||||||
|
],
|
||||||
|
],
|
||||||
|
'configuration' => [],
|
||||||
|
]);
|
||||||
|
|
||||||
|
$this->actingAs($user);
|
||||||
|
|
||||||
|
$test = Volt::test('plugins.recipe', ['plugin' => $plugin])
|
||||||
|
->assertSeeHtml($expectedSee);
|
||||||
|
|
||||||
|
foreach ($forbidden as $malice) {
|
||||||
|
$test->assertDontSeeHtml($malice);
|
||||||
|
}
|
||||||
|
})->with('xss_vectors');
|
||||||
|
|
||||||
|
test('plugin configuration help_text is sanitized', function (string $input, string $expectedSee, array $forbidden) : void {
|
||||||
|
$user = User::factory()->create();
|
||||||
|
|
||||||
|
$plugin = Plugin::create([
|
||||||
|
'user_id' => $user->id,
|
||||||
|
'name' => 'Help Text Security Test',
|
||||||
|
'data_stale_minutes' => 15,
|
||||||
|
'data_strategy' => 'static',
|
||||||
|
'polling_verb' => 'get',
|
||||||
|
'configuration_template' => [
|
||||||
|
'custom_fields' => [
|
||||||
|
[
|
||||||
|
'keyname' => 'test',
|
||||||
|
'field_type' => 'string',
|
||||||
|
'name' => 'Secure Field',
|
||||||
|
'help_text' => $input,
|
||||||
|
],
|
||||||
|
],
|
||||||
|
],
|
||||||
|
'configuration' => [],
|
||||||
|
]);
|
||||||
|
|
||||||
|
$this->actingAs($user);
|
||||||
|
|
||||||
|
$test = Volt::test('plugins.recipe', ['plugin' => $plugin])
|
||||||
|
->assertSeeHtml($expectedSee);
|
||||||
|
|
||||||
|
foreach ($forbidden as $malice) {
|
||||||
|
$test->assertDontSeeHtml($malice);
|
||||||
|
}
|
||||||
|
})->with('xss_vectors');
|
||||||
|
|
|
||||||
Loading…
Add table
Add a link
Reference in a new issue