'lit-html': patch

Added an additional check to prevent spoofing of internal lit types in data bindings.

.vscode/

.vscode/

.vscode/

// A security check to prevent spoofing of Lit template results.

// In the future, we may be able to replace this with Array.isTemplateObject,

// though we might need to make that check inside of the html and svg

// functions, because precompiled templates don't come in as

// TemplateStringArray objects.

if (!Array.isArray(strings) || !strings.hasOwnProperty('raw')) {

let message = 'invalid template strings array';

if (DEV_MODE) {

message =

`Internal Error: expected template strings to be an array ` +

`with a 'raw' field. Please file a bug at ` +

`https://github.com/lit/lit/issues/new?template=bug_report.md ` +

`and include information about your build tooling, if any.`;

}

throw new Error(message);

}

// Beware: in general this pattern is unsafe, and doing so may bypass

// lit's security checks and allow an attacker to execute arbitrary

// code and inject arbitrary content.

// eslint-disable-next-line @typescript-eslint/no-explicit-any

(staticStrings as any).raw = staticStrings;

test(`don't render simple spoof template results`, () => {

const spoof = {

['_$litType$']: 1,

strings: ['<div>spoofed string</div>'],

values: [],

};

const template = html`<div>${spoof}</div>`;

let threwError = false;

try {

render(template, container);

} catch {

threwError = true;

}

assert.equal(stripExpressionMarkers(container.innerHTML), '');

assert.isTrue(

threwError,

`Expected an error when rendering a spoofed template result`

);

});