From c939c33fd3dca9a2b21960866031b5ec9dad0123 Mon Sep 17 00:00:00 2001 From: Guilherme Soares Date: Thu, 23 Jan 2025 17:43:38 +0000 Subject: [PATCH] parser/pageparser: Don't allow parameters after closing tag in shortcodes Problem: Previously, the following self-closing shortcode syntax was incorrectly allowed: {{% sc / param %}} Solution: Only allow parameters before the self-closing tag --- parser/pageparser/pagelexer_shortcode.go | 1 + parser/pageparser/pageparser_shortcode_test.go | 3 +++ 2 files changed, 4 insertions(+) diff --git a/parser/pageparser/pagelexer_shortcode.go b/parser/pageparser/pagelexer_shortcode.go index def2f82c7..535d8192c 100644 --- a/parser/pageparser/pagelexer_shortcode.go +++ b/parser/pageparser/pagelexer_shortcode.go @@ -322,6 +322,7 @@ func lexInsideShortcode(l *pageLexer) stateFunc { } l.closingState++ l.isInline = false + l.elementStepNum = 0 l.emit(tScClose) case r == '\\': l.ignore() diff --git a/parser/pageparser/pageparser_shortcode_test.go b/parser/pageparser/pageparser_shortcode_test.go index 327da30ee..29626b6ad 100644 --- a/parser/pageparser/pageparser_shortcode_test.go +++ b/parser/pageparser/pageparser_shortcode_test.go @@ -126,6 +126,9 @@ var shortCodeLexerTests = []lexerTest{ {"self-closing with param", `{{< sc1 param1 />}}`, []typeText{ tstLeftNoMD, tstSC1, tstParam1, tstSCClose, tstRightNoMD, tstEOF, }, nil}, + {"self-closing with extra keyword", `{{< sc1 / keyword>}}`, []typeText{ + tstLeftNoMD, tstSC1, tstSCClose, nti(tError, "closing tag for shortcode 'keyword' does not match start tag"), + }, nil}, {"multiple self-closing with param", `{{< sc1 param1 />}}{{< sc1 param1 />}}`, []typeText{ tstLeftNoMD, tstSC1, tstParam1, tstSCClose, tstRightNoMD, tstLeftNoMD, tstSC1, tstParam1, tstSCClose, tstRightNoMD, tstEOF,