Treat pattern attribute of form elements as JS context in Template v2

This commit is contained in:
Kijin Sung 2025-06-17 17:15:49 +09:00
parent 170aab3ca8
commit dd4d4fe979
2 changed files with 9 additions and 1 deletions

View file

@ -185,7 +185,7 @@ class TemplateParser_v2
}, $content);
// Inline scripts.
$content = preg_replace_callback('#(?<=\s)(href="javascript:|on[a-z]+=")([^"]*?)"#i', function($match) {
$content = preg_replace_callback('#(?<=\s)(href="javascript:|pattern="|on[a-z]+=")([^"]*?)"#i', function($match) {
return $match[1] . '<?php $this->config->context = \'JS\'; ?>' . $match[2] . '<?php $this->config->context = \'HTML\'; ?>"';
}, $content);

View file

@ -265,6 +265,14 @@ class TemplateParserV2Test extends \Codeception\Test\Unit
$target = '<div class="foo" onClick="<?php $this->config->context = \'JS\'; ?>bar.barr()<?php $this->config->context = \'HTML\'; ?>">Hello</div>';
$this->assertEquals($target, $this->_parse($source, true, false));
// pattern attribute in <input> tag
$source = '<input type="text" pattern="[a-z0-9]{4,8}" value="Hello" />';
$target = '<input type="text" pattern="<?php $this->config->context = \'JS\'; ?>[a-z0-9]{4,8}<?php $this->config->context = \'HTML\'; ?>" value="Hello" />';
$this->assertEquals($target, $this->_parse($source, true, false));
$source = '<input type="text" pattern="[{{ $chars }}]{4,8}" value="Hello" />';
$target = '<input type="text" pattern="<?php $this->config->context = \'JS\'; ?>[<?php echo $this->config->context === \'HTML\' ? htmlspecialchars($__Context->chars ?? \'\', \ENT_QUOTES, \'UTF-8\', false) : $this->_v2_escape($__Context->chars ?? \'\'); ?>]{4,8}<?php $this->config->context = \'HTML\'; ?>" value="Hello" />';
$this->assertEquals($target, $this->_parse($source, true, false));
// <style> tag
$source = '<style> body { font-size: 16px; } </style>';
$target = '<style<?php $this->config->context = \'CSS\'; ?>> body { font-size: 16px; } <?php $this->config->context = \'HTML\'; ?></style>';