Skip to content

Commit a3c89d6

Browse files
committed
docs(showcases): remove http syntax highlighting in django-unicorn guide
Updates code blocks to use generic formatting instead of explicit HTTP syntax highlighting. This ensures better compatibility with documentation rendering and avoids potential highlighting artifacts in examples that combine HTTP-like structures with JSON payloads.
1 parent 5281c04 commit a3c89d6

1 file changed

Lines changed: 8 additions & 8 deletions

File tree

website/source/content/docs/collection/showcases/django-unicorn.md

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -65,7 +65,7 @@ The function performs both `getattr` and `__getitem__` for resolution (Agnostic-
6565

6666
This functionality is triggered via component requests by specifying the request type as `syncInput`:
6767

68-
```http
68+
```
6969
POST /unicorn/message/COMPONENT_NAME
7070
7171
{
@@ -93,7 +93,7 @@ By setting `property_name` to a path like `__init__.__globals__`, the component
9393

9494
Django-Unicorn uses the `EntitySubstitution` rule from BeautifulSoup to sanitize HTML in template responses. This rule is stored in a global dictionary that can be polluted.
9595

96-
```http
96+
```
9797
POST /unicorn/message/todo HTTP/1.1
9898
9999
{
@@ -121,7 +121,7 @@ POST /unicorn/message/todo HTTP/1.1
121121

122122
Django-Unicorn always includes a script tag in the webpage where a `NAME` value is dynamically extracted from the `MORPHER_NAMES` and `DEFAULT_MORPHER_NAME` variables in the settings module. Django by default escapes special characters into unicode sequences via the `_json_script_escapes` variable. By clearing this sanitizer and polluting the settings, we achieve stored XSS.
123123

124-
```http
124+
```
125125
POST /unicorn/message/todo HTTP/1.1
126126
127127
{
@@ -164,7 +164,7 @@ POST /unicorn/message/todo HTTP/1.1
164164

165165
Django stores its error page source code in the global variable `ERROR_PAGE_TEMPLATE` at `django/views/defaults.py`. By polluting this variable, any user triggering an error (e.g., accessing a nonexistent resource) will execute the attacker's payload.
166166

167-
```http
167+
```
168168
POST /unicorn/message/todo HTTP/1.1
169169
170170
{
@@ -192,7 +192,7 @@ POST /unicorn/message/todo HTTP/1.1
192192

193193
Django's `SECRET_KEY` is used to sign and verify session cookies and other security mechanisms. By polluting its runtime value, an attacker can forge session cookies to log in as any user.
194194

195-
```http
195+
```
196196
POST /unicorn/message/todo HTTP/1.1
197197
198198
{
@@ -220,7 +220,7 @@ POST /unicorn/message/todo HTTP/1.1
220220

221221
The `timed` decorator is used to wrap many important functions in django-unicorn, such as `_call_method_name`. By polluting it to a string, all decorated function calls become uncallable.
222222

223-
```http
223+
```
224224
POST /unicorn/message/todo HTTP/1.1
225225
226226
{
@@ -250,7 +250,7 @@ By polluting the `location_cache` object, attackers achieve arbitrary module imp
250250

251251
**Step 1**: Pollute `location_cache` to trigger `antigravity` module import on next request:
252252

253-
```http
253+
```
254254
POST /unicorn/message/todo HTTP/1.1
255255
256256
{
@@ -277,7 +277,7 @@ POST /unicorn/message/todo HTTP/1.1
277277

278278
**Step 2**: Pollute `BROWSER` environment variable with the command injection payload:
279279

280-
```http
280+
```
281281
POST /unicorn/message/todo HTTP/1.1
282282
283283
{

0 commit comments

Comments
 (0)