Repository navigation
feat: prepare v0.0.8 - #213
Merged
Merged
Conversation
The SVG upload sanitiser cleared javascript:, vbscript: and unsafe data: URIs only in quoted attribute values. An unquoted value such as <a href=javascript:alert(1)> passed through unchanged, so an uploaded SVG opened directly on cloudcdn.pro could run script on that origin when the link was followed. Cause: stripUnsafeUriValues ran isUnsafeUriValue on the quoted branch only; the unquoted branch copied the value through. Fix: read quoted and unquoted values through one path (readable sticky scanners) so every value gets the same check. A trailing "/>" stays outside an unquoted value, so a cleared self-closing tag stays well-formed. The function is split into helpers that meet the complexity ceilings, and the baseline drops its three entries. Verified: - New regression tests fail on the previous code and pass now. - The 58 sanitiser tests and the full suite (3839 tests) pass. - Differential run of old vs new sanitizeSvg over 200,000 generated tag sequences: 183,869 identical, 16,131 differ only where the old output kept an unquoted unsafe URI that the new output clears, 0 other differences. Fixes: eb1a37e ("security: replace regex SVG sanitizer with string-walker state machine") Assisted-by: Claude Code:claude-opus-5-5 eslint Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Sebastien Rousseau <sebastienrousseau@users.noreply.github.com>
Bump the site to 0.0.8 and record the SVG sanitiser fix (GHSA-83v7-xc9g-5frf) in CHANGELOG.md and docs/releases/v0.0.8.md. Assisted-by: Claude Code:claude-opus-5-5 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Sebastien Rousseau <sebastienrousseau@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR fixes GHSA-83v7-xc9g-5frf: the SVG sanitiser now clears unsafe URIs in unquoted attribute values, and prepares 0.0.8.
An uploaded SVG with
<a href=javascript:...>(no quotes) kept the link, so opening it on cloudcdn.pro could run script on that origin.Highlights ⭐️
javascript:,vbscript:and unsafedata:URIs are cleared whether the value is quoted or not; a trailing/>stays outside the value so cleared self-closing tags stay well-formed.stripUnsafeUriValuesis split into small helpers; the complexity baseline shrinks by three entries.What's Changed
fix(security): clear unquoted unsafe svg urisby @sebastienrousseauchore(release): prepare v0.0.8by @sebastienrousseauValidation
npx vitest run scripts/tests/pipeline.test.js: the new regression test fails on the 0.0.7 code (1 failed, 57 passed) and passes with the fix (58 passed).npm test: 95 files, 3839 tests pass.npm run lint: clean.sanitizeSvgover 200,000 generated tag sequences: 183,869 identical, 16,131 differ only where 0.0.7 kept an unquoted unsafe URI that the fix clears, 0 other differences.Checksums
SHA-256 of the artifact produced by
git archive HEAD | gzip -non this branch:Full Changelog: v0.0.7...v0.0.8