Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat(jsx): improve meta-tag types with well known values #3276

Merged
merged 2 commits into from
Aug 17, 2024

Conversation

ssssota
Copy link
Contributor

@ssssota ssssota commented Aug 15, 2024

Improve meta-tag types with well known values like c.header (#3221) .

Now, we can use auto-completion in JSX:
image

The author should do the following, if applicable

  • Add tests
  • Run tests
  • bun run format:fix && bun run lint:fix to format the code
  • Add TSDoc/JSDoc to document the code

Copy link

codecov bot commented Aug 16, 2024

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 96.20%. Comparing base (a5b2382) to head (6df2113).
Report is 3 commits behind head on main.

Additional details and impacted files
@@           Coverage Diff           @@
##             main    #3276   +/-   ##
=======================================
  Coverage   96.20%   96.20%           
=======================================
  Files         151      151           
  Lines       15293    15293           
  Branches     2639     2666   +27     
=======================================
  Hits        14713    14713           
  Misses        580      580           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

@@ -466,15 +466,73 @@ export namespace JSX {
src?: string | undefined
}

/**
* String literal types with auto-complition
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

auto-complition is a typo. Should be auto-completion.

@yusukebe
Copy link
Member

Hi @ssssota

I'm not sure if which is 100% great, but I think it would be better it does not use LiteralUnion in MetaHttpEquiv , MetaName, or others. These can be more strict. What do you think of it?

diff --git a/src/jsx/intrinsic-elements.ts b/src/jsx/intrinsic-elements.ts
index ee0a80eb..90cfc111 100644
--- a/src/jsx/intrinsic-elements.ts
+++ b/src/jsx/intrinsic-elements.ts
@@ -467,69 +467,68 @@ export namespace JSX {
   }
 
   /**
-   * String literal types with auto-complition
+   * String literal types with auto-completion
    * @see https://github.com/Microsoft/TypeScript/issues/29729
    */
   type LiteralUnion<T> = T | (string & Record<never, never>)
+
   /**
    * @see https://developer.mozilla.org/en-US/docs/Web/HTML/Element/meta#http-equiv
    */
   type MetaHttpEquiv =
-    | LiteralUnion<
-        'content-security-policy' | 'content-type' | 'default-style' | 'x-ua-compatible' | 'refresh'
-      >
-    | undefined
+    | 'content-security-policy'
+    | 'content-type'
+    | 'default-style'
+    | 'x-ua-compatible'
+    | 'refresh'
+
   /**
    * @see https://developer.mozilla.org/en-US/docs/Web/HTML/Element/meta/name
    */
   type MetaName =
-    | LiteralUnion<
-        | 'application-name'
-        | 'author'
-        | 'description'
-        | 'generator'
-        | 'keywords'
-        | 'referrer'
-        | 'theme-color'
-        | 'color-scheme'
-        | 'viewport'
-        | 'creator'
-        | 'googlebot'
-        | 'publisher'
-        | 'robots'
-      >
-    | undefined
+    | 'application-name'
+    | 'author'
+    | 'description'
+    | 'generator'
+    | 'keywords'
+    | 'referrer'
+    | 'theme-color'
+    | 'color-scheme'
+    | 'viewport'
+    | 'creator'
+    | 'googlebot'
+    | 'publisher'
+    | 'robots'
+
   /**
    * @see https://ogp.me/
    */
   type MetaProperty =
-    | LiteralUnion<
-        | 'og:title'
-        | 'og:type'
-        | 'og:image'
-        | 'og:url'
-        | 'og:audio'
-        | 'og:description'
-        | 'og:determiner'
-        | 'og:locale'
-        | 'og:locale:alternate'
-        | 'og:site_name'
-        | 'og:video'
-        | 'og:image:url'
-        | 'og:image:secure_url'
-        | 'og:image:type'
-        | 'og:image:width'
-        | 'og:image:height'
-        | 'og:image:alt'
-      >
-    | undefined
+    | 'og:title'
+    | 'og:type'
+    | 'og:image'
+    | 'og:url'
+    | 'og:audio'
+    | 'og:description'
+    | 'og:determiner'
+    | 'og:locale'
+    | 'og:locale:alternate'
+    | 'og:site_name'
+    | 'og:video'
+    | 'og:image:url'
+    | 'og:image:secure_url'
+    | 'og:image:type'
+    | 'og:image:width'
+    | 'og:image:height'
+    | 'og:image:alt'
+
   interface MetaHTMLAttributes extends HTMLAttributes {
     charset?: LiteralUnion<'utf-8'> | undefined
-    'http-equiv'?: MetaHttpEquiv
-    name?: MetaName
+    'http-equiv'?: LiteralUnion<MetaHttpEquiv>
+    name?: LiteralUnion<MetaName>
     media?: string | undefined
     content?: string | undefined
-    property?: MetaProperty
+    property?: LiteralUnion<MetaProperty>
 
     // React 19 compatibility
     httpEquiv?: MetaHttpEquiv

@ssssota
Copy link
Contributor Author

ssssota commented Aug 16, 2024

@yusukebe Thank you for the review! I've applied suggestions. It looks better!

@ssssota ssssota requested a review from yusukebe August 16, 2024 11:29
@yusukebe yusukebe changed the title fix(jsx): improve meta-tag types with well known values feat(jsx): improve meta-tag types with well known values Aug 17, 2024
Copy link
Member

@yusukebe yusukebe left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM!

@yusukebe
Copy link
Member

@ssssota

Looks good! This is actually a new feature, but it's minor, so I've labeled it feat and will merge it into the main. Then, I will release the patch version to include this change. Thanks!

@yusukebe yusukebe merged commit f800cf1 into honojs:main Aug 17, 2024
14 checks passed
@ssssota ssssota deleted the feat/improve-meta-tag-types branch August 17, 2024 15:18
adamnolte referenced this pull request in autoblocksai/cli Aug 22, 2024
[![Mend
Renovate](https://app.renovatebot.com/images/banner.svg)](https://renovatebot.com)

This PR contains the following updates:

| Package | Change | Age | Adoption | Passing | Confidence |
|---|---|---|---|---|---|
| [hono](https://hono.dev/) ([source](https://togithub.com/honojs/hono))
| [`4.5.5` ->
`4.5.8`](https://renovatebot.com/diffs/npm/hono/4.5.5/4.5.8) |
[![age](https://developer.mend.io/api/mc/badges/age/npm/hono/4.5.8?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|
[![adoption](https://developer.mend.io/api/mc/badges/adoption/npm/hono/4.5.8?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|
[![passing](https://developer.mend.io/api/mc/badges/compatibility/npm/hono/4.5.5/4.5.8?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|
[![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/hono/4.5.5/4.5.8?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|

### GitHub Vulnerability Alerts

####
[CVE-2024-43787](https://togithub.com/honojs/hono/security/advisories/GHSA-rpfr-3m35-5vx5)

### Summary

Hono CSRF middleware can be bypassed using crafted Content-Type header.

### Details

MIME types are case insensitive, but `isRequestedByFormElementRe` only
matches lower-case.


https://github.com/honojs/hono/blob/b0af71fbcc6dbe44140ea76f16d68dfdb32a99a0/src/middleware/csrf/index.ts#L16-L17

As a result, attacker can bypass csrf middleware using upper-case
form-like MIME type, such as "Application/x-www-form-urlencoded".

### PoC

```html
<html>
  <head>
    <title>CSRF Test</title>
    <script defer>
      document.addEventListener("DOMContentLoaded", () => {
        document.getElementById("btn").addEventListener("click", async () => {
          const res = await fetch("http://victim.example.com/test", {
            method: "POST",
            credentials: "include",
            headers: {
              "Content-Type": "Application/x-www-form-urlencoded",
            },
          });
        });
      });
    </script>
  </head>
  <body>
    <h1>CSRF Test</h1>
    <button id="btn">Click me!</button>
  </body>
</html>
```

### Impact

Bypass csrf protection implemented with hono csrf middleware.

### Discussion

I'm not sure that omitting csrf checks for Simple POST request is a good
idea.
CSRF prevention and CORS are different concepts even though CORS can
prevent CSRF in some cases.

---

### Release Notes

<details>
<summary>honojs/hono (hono)</summary>

### [`v4.5.8`](https://togithub.com/honojs/hono/releases/tag/v4.5.8)

[Compare
Source](https://togithub.com/honojs/hono/compare/v4.5.7...v4.5.8)

##### Security Fix for CSRF Protection Middleware

Before this release, in versions 4.5.7 and below, the CSRF Protection
Middleware did not treat requests including `Content-Types` with
uppercase letters (e.g., `Application/x-www-form-urlencoded`) as
potential attacks, allowing them to pass.

This could cause unexpected behavior, leading to a vulnerability. If you
are using the CSRF Protection Middleware, please upgrade to version
4.5.8 or higher immediately.

For more details, see the report here:
GHSA-rpfr-3m35-5vx5

### [`v4.5.7`](https://togithub.com/honojs/hono/releases/tag/v4.5.7)

[Compare
Source](https://togithub.com/honojs/hono/compare/v4.5.6...v4.5.7)

#### What's Changed

- fix(jsx/dom): Fixed a bug that caused Script elements to turn into
Style elements. by [@&#8203;usualoma](https://togithub.com/usualoma) in
[https://github.com/honojs/hono/pull/3294](https://togithub.com/honojs/hono/pull/3294)
- perf(jsx/dom): improve performance by
[@&#8203;usualoma](https://togithub.com/usualoma) in
[https://github.com/honojs/hono/pull/3288](https://togithub.com/honojs/hono/pull/3288)
- feat(jsx): improve a-tag types with well known values by
[@&#8203;ssssota](https://togithub.com/ssssota) in
[https://github.com/honojs/hono/pull/3287](https://togithub.com/honojs/hono/pull/3287)
- fix(validator): Fixed a bug in hono/validator where URL Encoded Data
could not be validated if the Content-Type included charset. by
[@&#8203;uttk](https://togithub.com/uttk) in
[https://github.com/honojs/hono/pull/3297](https://togithub.com/honojs/hono/pull/3297)
- feat(jsx): improve `target` and `formtarget` attribute types by
[@&#8203;ssssota](https://togithub.com/ssssota) in
[https://github.com/honojs/hono/pull/3299](https://togithub.com/honojs/hono/pull/3299)
- docs(README): change Twitter to X by
[@&#8203;nakasyou](https://togithub.com/nakasyou) in
[https://github.com/honojs/hono/pull/3301](https://togithub.com/honojs/hono/pull/3301)
- fix(client): replace optional params to url correctly by
[@&#8203;yusukebe](https://togithub.com/yusukebe) in
[https://github.com/honojs/hono/pull/3304](https://togithub.com/honojs/hono/pull/3304)
- feat(jsx): improve input attribute types based on react by
[@&#8203;ssssota](https://togithub.com/ssssota) in
[https://github.com/honojs/hono/pull/3302](https://togithub.com/honojs/hono/pull/3302)

#### New Contributors

- [@&#8203;uttk](https://togithub.com/uttk) made their first
contribution in
[https://github.com/honojs/hono/pull/3297](https://togithub.com/honojs/hono/pull/3297)

**Full Changelog**:
honojs/hono@v4.5.6...v4.5.7

### [`v4.5.6`](https://togithub.com/honojs/hono/releases/tag/v4.5.6)

[Compare
Source](https://togithub.com/honojs/hono/compare/v4.5.5...v4.5.6)

#### What's Changed

- fix(jsx): handle async component error explicitly and throw the error
in the response by [@&#8203;usualoma](https://togithub.com/usualoma) in
[https://github.com/honojs/hono/pull/3274](https://togithub.com/honojs/hono/pull/3274)
- fix(validator): support multipart headers without a separating space
by [@&#8203;Ernxst](https://togithub.com/Ernxst) in
[https://github.com/honojs/hono/pull/3286](https://togithub.com/honojs/hono/pull/3286)
- fix(validator): Allow form data will mutliple values appended by
[@&#8203;nicksrandall](https://togithub.com/nicksrandall) in
[https://github.com/honojs/hono/pull/3273](https://togithub.com/honojs/hono/pull/3273)
- feat(jsx): improve meta-tag types with well known values by
[@&#8203;ssssota](https://togithub.com/ssssota) in
[https://github.com/honojs/hono/pull/3276](https://togithub.com/honojs/hono/pull/3276)

#### New Contributors

- [@&#8203;Ernxst](https://togithub.com/Ernxst) made their first
contribution in
[https://github.com/honojs/hono/pull/3286](https://togithub.com/honojs/hono/pull/3286)
- [@&#8203;ssssota](https://togithub.com/ssssota) made their first
contribution in
[https://github.com/honojs/hono/pull/3276](https://togithub.com/honojs/hono/pull/3276)

**Full Changelog**:
honojs/hono@v4.5.5...v4.5.6

</details>

---

### Configuration

📅 **Schedule**: Branch creation - "" in timezone America/Chicago,
Automerge - At any time (no schedule defined).

🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend
Renovate](https://www.mend.io/free-developer-tools/renovate/). View the
[repository job log](https://developer.mend.io/github/autoblocksai/cli).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzOC4yNi4xIiwidXBkYXRlZEluVmVyIjoiMzguMjYuMSIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOltdfQ==-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants