refactor(frontmatter): constrain frontmatter object after parsing

This change removes the meta-marked dependency which solely was
used for extracting the frontmatter, which is possible as well
with one function. Furthermore, this introduces constraints to
objects resulting from frontmatter parsing and enforces them in
order to prevent attacks like a yaml bomb (massive alias expansion).
This change should resolve a possible DoS attack.

Signed-off-by: Erik Michelson <github@erik.michelson.eu>
This commit is contained in:
Erik Michelson
2026-06-09 22:09:03 +02:00
parent fbd7307f16
commit c489497e45
10 changed files with 212 additions and 64 deletions

View File

@@ -1,4 +1,5 @@
<script src="config"></script>
<script src="build/constrain-object.min.js"></script>
<% for (var js in htmlWebpackPlugin.files.js) { %>
<script src="<%= htmlWebpackPlugin.files.js[js] %>" defer></script>
<% } %>

View File

@@ -15,7 +15,7 @@
<meta name="description" content="<%= description %>">
<% } %>
<% for (var og in opengraph) { %>
<% if (opengraph.hasOwnProperty(og) && opengraph[og].trim() !== '') { %>
<% if (opengraph.hasOwnProperty(og) && typeof opengraph[og] === 'string' && opengraph[og].trim() !== '') { %>
<meta property="og:<%= og %>" content="<%= opengraph[og] %>">
<% }} if (!opengraph.hasOwnProperty('image')) { %>
<meta property="og:image" content="<%- serverURL %>/icons/android-chrome-512x512.png">