From aaee6b3cbe7c30ff3470bf79eefe8df81c85bb10 Mon Sep 17 00:00:00 2001 From: Yuriy Date: Tue, 24 Jun 2025 10:57:25 +0300 Subject: [PATCH 1/6] Fix shared-constants module registration in app.js --- website/app.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/website/app.js b/website/app.js index f68b2cd1..8693d808 100644 --- a/website/app.js +++ b/website/app.js @@ -48,7 +48,7 @@ function createAposConfig() { 'global-data': {}, // Shared constants module - 'shared-constants': {}, + '@apostrophecms/shared-constants': {}, // Configure page types '@apostrophecms/rich-text-widget': {}, From f8016e3ae146bcf5513e86b70fe4f6128b52f51d Mon Sep 17 00:00:00 2001 From: Yuriy Date: Tue, 24 Jun 2025 10:59:00 +0300 Subject: [PATCH 2/6] Fix generate_constants.js to correctly generate data --- website/scripts/generate_constants.js | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/website/scripts/generate_constants.js b/website/scripts/generate_constants.js index bd100cb6..b82b7e90 100644 --- a/website/scripts/generate_constants.js +++ b/website/scripts/generate_constants.js @@ -44,12 +44,16 @@ try { */ // Direct export of constants for import { STANDARD_FORM_FIELD_NAMES } from '...' -export const STANDARD_FORM_FIELD_NAMES = ${JSON.stringify(STANDARD_FORM_FIELD_NAMES, null, 2)}; +export const STANDARD_FORM_FIELD_NAMES = { + ${Object.entries(STANDARD_FORM_FIELD_NAMES) + .map(([key, value]) => `${key}: '${value}'`) + .join(',\n ')}, +}; // Default export function for backwards compatibility export default () => { return { - STANDARD_FORM_FIELD_NAMES + STANDARD_FORM_FIELD_NAMES, }; }; `; From 7c0b098769c94ed5af847b02ff5cc042c6ddbe4c Mon Sep 17 00:00:00 2001 From: Yuriy Date: Tue, 24 Jun 2025 11:04:25 +0300 Subject: [PATCH 3/6] Fix string escaping vulnerability in generate_constants.js Replace manual object literal construction with JSON.stringify to: - Handle all escaping automatically - Preserve original data types - Provide proper formatting with 2-space indentation - Eliminate potential code injection risks --- website/scripts/generate_constants.js | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-) diff --git a/website/scripts/generate_constants.js b/website/scripts/generate_constants.js index b82b7e90..b3502a54 100644 --- a/website/scripts/generate_constants.js +++ b/website/scripts/generate_constants.js @@ -44,11 +44,7 @@ try { */ // Direct export of constants for import { STANDARD_FORM_FIELD_NAMES } from '...' -export const STANDARD_FORM_FIELD_NAMES = { - ${Object.entries(STANDARD_FORM_FIELD_NAMES) - .map(([key, value]) => `${key}: '${value}'`) - .join(',\n ')}, -}; +export const STANDARD_FORM_FIELD_NAMES = ${JSON.stringify(STANDARD_FORM_FIELD_NAMES, null, 2)}; // Default export function for backwards compatibility export default () => { From 3645afedaada630121cf5073135f033e06ca1655 Mon Sep 17 00:00:00 2001 From: Yuriy Date: Tue, 24 Jun 2025 11:09:49 +0300 Subject: [PATCH 4/6] Fix quote style in generated constants to match ESLint/Prettier rules Replace JSON.stringify with custom function that generates single quotes while maintaining proper escaping for security. This ensures the generated code follows project linting rules while preventing code injection risks. --- .../shared-constants/ui/src/index.js | 2 +- website/scripts/generate_constants.js | 14 +++++++++++++- 2 files changed, 14 insertions(+), 2 deletions(-) diff --git a/website/modules/@apostrophecms/shared-constants/ui/src/index.js b/website/modules/@apostrophecms/shared-constants/ui/src/index.js index 35ee58d8..a603c592 100644 --- a/website/modules/@apostrophecms/shared-constants/ui/src/index.js +++ b/website/modules/@apostrophecms/shared-constants/ui/src/index.js @@ -8,7 +8,7 @@ export const STANDARD_FORM_FIELD_NAMES = { FULL_NAME: 'full-name', EMAIL_ADDRESS: 'email-address', - PHONE_NUMBER: 'phone-number', + PHONE_NUMBER: 'phone-number' }; // Default export function for backwards compatibility diff --git a/website/scripts/generate_constants.js b/website/scripts/generate_constants.js index b3502a54..e88591c3 100644 --- a/website/scripts/generate_constants.js +++ b/website/scripts/generate_constants.js @@ -36,6 +36,18 @@ try { ); } + // Helper function to safely stringify object with single quotes + const stringifyWithSingleQuotes = (obj, indent = 2) => { + const spaces = ' '.repeat(indent); + const entries = Object.entries(obj) + .map( + ([key, value]) => + `${spaces}${key}: '${String(value).replace(/'/gu, "\\'")}'`, + ) + .join(',\n'); + return `{\n${entries}\n${' '.repeat(indent - 2)}}`; + }; + // Generate client-side constants file content const clientFileContent = `/* * Client-side access to shared constants. @@ -44,7 +56,7 @@ try { */ // Direct export of constants for import { STANDARD_FORM_FIELD_NAMES } from '...' -export const STANDARD_FORM_FIELD_NAMES = ${JSON.stringify(STANDARD_FORM_FIELD_NAMES, null, 2)}; +export const STANDARD_FORM_FIELD_NAMES = ${stringifyWithSingleQuotes(STANDARD_FORM_FIELD_NAMES)}; // Default export function for backwards compatibility export default () => { From ba36182fded80a96eb4a072ca5293473b91de530 Mon Sep 17 00:00:00 2001 From: Yuriy Date: Tue, 24 Jun 2025 12:34:52 +0300 Subject: [PATCH 5/6] Fix CodeQL security vulnerability: escape backslashes in string generation Fix incomplete string escaping by escaping backslashes first, then single quotes to prevent double escaping issues. This addresses the CodeQL 'Incomplete string escaping or encoding' high severity security warning. --- website/scripts/generate_constants.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/website/scripts/generate_constants.js b/website/scripts/generate_constants.js index e88591c3..c7b3e2c9 100644 --- a/website/scripts/generate_constants.js +++ b/website/scripts/generate_constants.js @@ -42,7 +42,7 @@ try { const entries = Object.entries(obj) .map( ([key, value]) => - `${spaces}${key}: '${String(value).replace(/'/gu, "\\'")}'`, + `${spaces}${key}: '${String(value).replace(/\\/gu, '\\\\').replace(/'/gu, "\\'")}'`, ) .join(',\n'); return `{\n${entries}\n${' '.repeat(indent - 2)}}`; From ccd093cb79e61b731cd152f7095dcc9f53669968 Mon Sep 17 00:00:00 2001 From: Yuriy Date: Tue, 24 Jun 2025 12:47:55 +0300 Subject: [PATCH 6/6] Add trailing comma to generated constants for ESLint/Prettier compliance Fix the prettier/prettier error by adding trailing comma to the last entry in the generated object. This ensures the auto-generated code follows project formatting rules. --- website/modules/@apostrophecms/shared-constants/ui/src/index.js | 2 +- website/scripts/generate_constants.js | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/website/modules/@apostrophecms/shared-constants/ui/src/index.js b/website/modules/@apostrophecms/shared-constants/ui/src/index.js index a603c592..35ee58d8 100644 --- a/website/modules/@apostrophecms/shared-constants/ui/src/index.js +++ b/website/modules/@apostrophecms/shared-constants/ui/src/index.js @@ -8,7 +8,7 @@ export const STANDARD_FORM_FIELD_NAMES = { FULL_NAME: 'full-name', EMAIL_ADDRESS: 'email-address', - PHONE_NUMBER: 'phone-number' + PHONE_NUMBER: 'phone-number', }; // Default export function for backwards compatibility diff --git a/website/scripts/generate_constants.js b/website/scripts/generate_constants.js index c7b3e2c9..de218fa8 100644 --- a/website/scripts/generate_constants.js +++ b/website/scripts/generate_constants.js @@ -45,7 +45,7 @@ try { `${spaces}${key}: '${String(value).replace(/\\/gu, '\\\\').replace(/'/gu, "\\'")}'`, ) .join(',\n'); - return `{\n${entries}\n${' '.repeat(indent - 2)}}`; + return `{\n${entries},\n${' '.repeat(indent - 2)}}`; }; // Generate client-side constants file content