doT

doT copied to clipboard

vulnerable undefined property lookup that escalating prototype pollution to remote code execution

1

Hello, I've identified another prototype pollution gadget within the doT template engine that could potentially be leveraged by attackers to achieve remote code execution via prototype pollution vulnerabilities. It is...

jackfromeast

i found doT library v1.1.3 this is a poc ``` const doT = require('dot'); doT.templateSettings = { evaluate: /\{\{([\s\S]+?(\}?)+)\}\}/g, interpolate: /\{\{=([\s\S]+?)\}\}/g, encode: /\{\{!([\s\S]+?)\}\}/g, use: /\{\{#([\s\S]+?)\}\}/g, define: /\{\{##\s*([\w\.$]+)\s*(\:|=)([\s\S]+?)#\}\}/g, conditional: /\{\{\?(\?)?\s*([\s\S]*?)\s*\}\}/g, iterate:...

shyeun

Update README.md with correct website link. Old link was not working as it was not pointing to github pages domain (.io)

insumanth

guiseek

Doc link from readme not working anymore

3

http://olado.github.com/doT that link generates 404 instead of documentation

Systerr

Typo fix for "achieve"

mattferderer

control instructions should not be counted as white space

2

Given this template, it should render a CSV output with **no** empty lines ```dot host,pin,subject {{~ it :e }} {{=e.host}},{{=e.hash}},{{=e.subject.CN}} {{~}} ``` However, the output contains an empty line after...

pke

Pass parameter to snippet

1

Hi everybody! Currently I'm having an issue while trying to pass a parameter to a function inside a snippet from another file. I'm running the latest version of doT. This...

arlopezg

Using single curly braces as delimiters doesn't work

1

I was messing around with the new `delimiters` option released in `2.0.0-beta.1` and found out that setting `{` and `}` as `start` and `end` delimiters respectively, breaks in some cases....

nfantone

readme: fix link to olado.github.io, http -> https

2

milahu