Template injection vulnerability when using variables inside conditionals

[felipeptcho]

I opened this issue in the posthtml-expressions repository, but it seems things are a bit slow there. Since this issue directly affects the Maizzle framework, I decided to cross-post it here as well for visibility.

See: posthtml/posthtml-expressions#149

• Maizzle Version: 4.4.6
• Node.js Version: 16.20.1

[cossssmin]

Opening one issue in the correct repo should do it, you won’t get help faster if you duplicate it around.

Sometimes things can be slower in open source, yes. You can help speed it up with a pull request :)

[felipeptcho]

You are just seeing one side of things. This issue doesn't affect me directly, so my only interest here is to make Maizzle users aware of this big problem. It's not always clear that Maizzle uses posthtml-expressions.

Also, this is a security issue that can be exploited. I think we should be more responsible and give it some visibility, so users can at least use the workaround. It usually should be given higher priority even in open source projects.

What can be done on Maizzle side? Having a visible ticket to track the issue is the minimum that we can do. An official note, a blog post or planning about replacing posthtml-expressions would be better. :)