StyAndCo/zeppelin
3
0
Fork 0
mirror of https://github.com/ZeppelinBot/Zeppelin.git synced 2025-03-15 05:41:51 +00:00
Code Releases Activity

fix: additional checks for tag set/get

Browse source
This commit is contained in:
Dragory 2023-04-01 22:13:48 +03:00
parent c1a91d4dec
commit ef36ea6999
No known key found for this signature in database
GPG key ID: 5F387BA66DF8AAC1
1 changed files with 8 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

9
backend/src/plugins/Tags/util/renderTagBody.ts
View file

@ -6,6 +6,9 @@ import { findTagByName } from "./findTagByName";
const MAX_TAG_FN_CALLS = 25; const MAX_TAG_FN_CALLS = 25;
// This is used to disallow setting/getting default object properties (such as __proto__) in dynamicVars
const emptyObject = {};
export async function renderTagBody( export async function renderTagBody(
pluginData: GuildPluginData<TagsPluginType>, pluginData: GuildPluginData<TagsPluginType>,
body: TTag, body: TTag,
@ -22,15 +25,19 @@ export async function renderTagBody(
...pluginData.state.tagFunctions, ...pluginData.state.tagFunctions,
set(name, val) { set(name, val) {
if (typeof name !== "string") return; if (typeof name !== "string") return;
if (emptyObject[name]) return;
dynamicVars[name] = val; dynamicVars[name] = val;
}, },
setr(name, val) { setr(name, val) {
if (typeof name !== "string") return ""; if (typeof name !== "string") return "";
if (emptyObject[name]) return;
dynamicVars[name] = val; dynamicVars[name] = val;
return val; return val;
}, },
get(name) { get(name) {
return !dynamicVars.hasOwnProperty(name) || dynamicVars[name] == null ? "" : dynamicVars[name]; if (typeof name !== "string") return "";
if (emptyObject[name]) return;
return !Object.hasOwn(dynamicVars, name) || dynamicVars[name] == null ? "" : dynamicVars[name];
}, },
tag: async (name, ...subTagArgs) => { tag: async (name, ...subTagArgs) => {
if (++tagFnCallsObj.calls > MAX_TAG_FN_CALLS) return ""; if (++tagFnCallsObj.calls > MAX_TAG_FN_CALLS) return "";