Open bbbco opened 3 years ago
Same thing happens if you try to do the function calculation in the root variable and refer to it in the nested object. For example:
{
"first_name": "Bobby",
"last_name": "'; DROP TABLES;'",
"full_name": "{{ _.first_name }} {{ _.last_name }}",
"baseEncodedRoot": "{% base64 'encode', 'normal', _.full_name %}",
"sub": {
"baseEncodedSub": "{{_.baseEncodedRoot}}"
}
}
_.baseEncodedRoot
is calculated correctly. However, _.sub.baseEncodedSub
is not (the base64 function uses the literal {{ _.first_name }} {{ _.last_name }}
)
Also, this is not just relegated to the Base64 function. This can be swapped out for one of the hashing functions with the same results.
This also seems to only occur on the Base Environment; the variable is rendered correctly when a Sub Environment is selected.
Describe the bug When using Environment Variables, functions/tags inside a nested block referring to another Environment Variable that is constructed from an environment variable do not use the calculated variable value; instead the literal string is used. This only seems to impact functions, as direct references to these variables seem to still work.
To Reproduce Steps to reproduce the behavior:
_.baseEncodedRoot
and_.sub.baseEncodedSub
tags and notice that they are both listed as having the same value.Bobby '; DROP TABLES;'
; CORRECT), whereas the sub value is the literal string of the referenced value (i.e.,{{ _.first_name }} {{ _.last_name }}
; INCORRECT)Expected behavior Usage of a tag/function that refers to another variable that is constructed from other variables should be the same whether it is on the root or nested in a block.
Screenshots
Desktop (please complete the following information):
Additional context This was first discovered while using the Default Headers plugin to construct a header. After digging into things, I realized it wasn't an issue with the default headers plugin but has to do with the way the variables are being rendered outside the Manage Environments section.