Merge branch 'codex/add-creator-studio-pack-scaffold-prompt' into copilot/sub-pr-1-again
This commit is contained in:
@@ -17,7 +17,7 @@ export const workflowTemplateSchema = z.object({
|
|||||||
id: z.string(),
|
id: z.string(),
|
||||||
description: z.string(),
|
description: z.string(),
|
||||||
engine: z.enum(['canva', 'ffmpeg']),
|
engine: z.enum(['canva', 'ffmpeg']),
|
||||||
template: z.record(z.any()),
|
template: z.unknown(),
|
||||||
});
|
});
|
||||||
|
|
||||||
export type PromptPreset = z.infer<typeof promptPresetSchema>;
|
export type PromptPreset = z.infer<typeof promptPresetSchema>;
|
||||||
|
|||||||
@@ -1,6 +1,9 @@
|
|||||||
import Handlebars from 'handlebars';
|
import Handlebars from 'handlebars';
|
||||||
|
|
||||||
export const renderTemplate = <T extends object>(source: string, context: T): string => {
|
export const renderTemplate = <T extends object>(source: string, context: T): string => {
|
||||||
|
// WARNING: 'noEscape: true' disables HTML escaping in Handlebars templates.
|
||||||
|
// This is intentional for non-HTML contexts (e.g., JSON), but can lead to injection vulnerabilities
|
||||||
|
// if used with untrusted user input. Ensure that 'context' is trusted and sanitized before use.
|
||||||
const template = Handlebars.compile(source, { noEscape: true });
|
const template = Handlebars.compile(source, { noEscape: true });
|
||||||
return template(context);
|
return template(context);
|
||||||
};
|
};
|
||||||
|
|||||||
Reference in New Issue
Block a user