Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Get Context Fortification #1234

Merged
merged 2 commits into from
Dec 23, 2024
Merged

Get Context Fortification #1234

merged 2 commits into from
Dec 23, 2024

Conversation

korgon
Copy link
Contributor

@korgon korgon commented Dec 20, 2024

The recent change to getContext (0.62.0) adding "auto-detect variables for evaluation list" had an unexpected side effect of generating errors when the auto-detected variable was a Javascript keyword.

Example:

format = "<span class=money>${{amount}}</span>";

The variable class was being extracted and added to the evaluate list.

Changes:

  1. prevent extracting variables within quotes
  2. adding a keyword set to ensure we never attempt to assign variables using these keywords
  3. wrapping evaluation in a try/catch to ensure Snap execution continues

dkonieczek
dkonieczek previously approved these changes Dec 20, 2024
@korgon korgon merged commit 1490979 into develop Dec 23, 2024
1 check passed
@korgon korgon deleted the getcontext-fortification branch December 23, 2024 18:44
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants